CVE-2025-24023: 
Python vulnerability analysis and mitigation

Flask-AppBuilder, an application development framework, was found to contain a security vulnerability (CVE-2025-24023) that affects versions prior to 4.5.3. The vulnerability was discovered and disclosed on March 3, 2025, allowing unauthenticated users to enumerate existing usernames through timing-based attacks (NVD, GitHub Advisory).

The vulnerability exists in Flask-AppBuilder versions below 4.5.3 when used with werkzeug >= 3.0.0. It enables unauthorized users to enumerate existing usernames by analyzing the timing differences in server responses during brute force attempts against the login functionality. The vulnerability has been assigned a CVSS v3.1 base score of 3.7 (Low) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N (GitHub Advisory).

The vulnerability allows attackers to determine valid usernames within the system through timing analysis, potentially facilitating further attacks by identifying legitimate user accounts. The impact is primarily on confidentiality, with no direct effect on system integrity or availability (GitHub Advisory).

Two mitigation options are available: upgrading Flask-AppBuilder to version 4.5.3 or later, or downgrading werkzeug to a version below 3.0.0 (GitHub Advisory).