{"id":"CVE-2021-23385","details":"This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\\\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore.","aliases":["GHSA-cg8c-gc2j-2wf7"],"modified":"2026-04-16T00:03:45.148387725Z","published":"2022-08-02T14:15:10.017Z","related":["SUSE-SU-2022:3834-1","SUSE-SU-2022:3867-1","openSUSE-SU-2024:13561-1","openSUSE-SU-2024:14555-1"],"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00034.html"},{"type":"ADVISORY","url":"https://snyk.io/blog/url-confusion-vulnerabilities/"},{"type":"PACKAGE","url":"https://github.com/mattupstate/flask-security"},{"type":"EVIDENCE","url":"https://security.snyk.io/vuln/SNYK-PYTHON-FLASKSECURITY-1293234"}],"affected":[{"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-23385.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}