PT-2025-28174 · Pypi · Flask-Boilerplate

Rui Yang + 1 · Published 2025-07-07 · Updated 2025-07-07 · CVE-2025-43931

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: flask-boilerplate versions through a170e7c

Description: The issue allows account takeover via the password reset feature. This is because the SERVER NAME is not configured, and thus the password reset depends on the Host HTTP header.

Recommendations: For versions through a170e7c, configure the SERVER NAME to prevent the password reset feature from depending on the Host HTTP header. As a temporary workaround, consider restricting access to the password reset feature until the SERVER NAME is properly configured.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2025-43931

Affected Products

Flask-Boilerplate

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-43931 · Security Note
• https://github.com/MaxHalford/flask-boilerplate/blob/a170e7cec605906801680567c4279b30ccd9630b/app/views/user.py#L103-L126 · Note
• https://twitter.com/CVEnew/status/1942246216534036762 · Twitter Post
• https://gist.github.com/BrookeYangRui/19fcc6c19df7bb4d8437476c609a6129 · Note