{"action":"Upgrade flask-security-too to 5.3.3 or later.","affected":[{"fixed":"5.3.3","introduced":"0"}],"component":"flask-security-too","cve_ids":["CVE-2023-49438"],"ecosystem":"PyPI","epss":0.01079,"exploited":false,"fixed_versions":["5.3.3"],"ghsa_id":"GHSA-672h-6x89-76m5","id":"tcs_01M5KGK40HBDHM127B9XNAV78R","modified_at":"2026-06-10T17:01:17.257583819Z","published_at":"2023-12-26T22:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-248","https://github.com/Flask-Middleware/flask-security","https://github.com/brandon-t-elliott/CVE-2023-49438","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HCYH377TPUMUHELPI36PDS2ZM4VFIXM/","https://github.com/advisories/GHSA-672h-6x89-76m5"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"PYSEC-2023-248","url":"https://osv.dev/vulnerability/PYSEC-2023-248"}],"summary":"An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on t"}