AIKIDO-2025-10932
Flask-Multipass is vulnerable to Open Redirect
75
High Risk
This Affects:
Flask-MultipassTL;DR
Affected versions of this package are vulnerable to open redirect attacks because the validation of next_url is insufficient. As a result, crafted values such as ////evil.com still pass the validation and cause the application to redirect users to an external domain. This enables attackers to construct malicious redirect links that appear legitimate, potentially leading to phishing or credential-harvesting scenarios.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
Flask-Multipass is vulnerable to Open Redirect in versions 0.1 - 0.10.
How to fix this
Upgrade the Flask-Multipass library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant