Flask-AppBuilder User Enumeration Vulnerability via Timing Attack

A user enumeration vulnerability has been identified in Flask-AppBuilder versions prior to 4.5.3. This issue allows unauthenticated users to enumerate existing usernames by exploiting a timing attack during the login process. The vulnerability arises from the application taking varying amounts of time to respond based on the existence of the username being guessed, thereby leaking information about valid usernames.

Impact

Exploitation of this vulnerability could lead to unauthorized username enumeration, potentially facilitating further attacks such as password guessing or phishing.

Remediation

Users are advised to upgrade Flask-AppBuilder to version 4.5.3 or later. If an upgrade is not possible, downgrading Werkzeug to a version prior to 3.0.0 is recommended.