# Vulnerability in long deprecated OpenID authentication method in Flask AppBuilder

DevFeed: [Vulnerability in long deprecated OpenID authentication method in Flask AppBuilder](<https://devfeed.tech/articles/vulnerability-in-long-deprecated-openid-authentication-method-in-flask-appbuilder-32562.md>)

Original publisher: [Read original article](<https://airflow.apache.org/blog/fab-oid-vulnerability/>)

Author: Apache Airflow

Published: 2024-02-26T00:00:00Z

Content type: article

Language: en

Sources: [Apache Airflow Blog](<https://devfeed.tech/sources/apache-airflow-blog.md>)

Topics: [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [airflow](<https://devfeed.tech/topics/airflow.md>), [Flask](<https://devfeed.tech/topics/flask.md>), [openid](<https://devfeed.tech/topics/openid.md>), [deprecated](<https://devfeed.tech/topics/deprecated.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>)

Tags: [airflow](<https://devfeed.tech/tags/airflow.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [deprecated](<https://devfeed.tech/tags/deprecated.md>), [flask](<https://devfeed.tech/tags/flask.md>), [openid](<https://devfeed.tech/tags/openid.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>), [version](<https://devfeed.tech/tags/version.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

This article describes a vulnerability in Flask AppBuilder's long-deprecated OpenID authentication method. Users with AUTH_OID configured could be exposed to identity takeover through a forged request and an attacker-controlled OpenID service. The article recommends switching authentication methods or upgrading to Apache Airflow 2.8.2, which uses Flask AppBuilder 4.3.11.

## Source excerpt

Vulnerability in long deprecated OpenID authentication method in Flask AppBuilder Recently Islam Rzayev made us aware of a vulnerability in the long deprecated OpenID authentication method in Flask AppBuilder. This vulnerability allowed a malicious user to take over the identity of any Airflow UI user by forging a specially crafted request and implementing their own OpenID service. While this is an old, deprecated and almost not used authentication method, we still took the issue seriously. This issue ONLY affects users who have AUTH_OID set in their webserver_config.py file as AUTH_TYPE. This is a very old and deprecated authentication method that is unlikely to be used by anyone. We would like to advise even the small number of our users that still use this authentication method to take an immediate action and either upgrade to Apache Airflow 2.8.2 or switch to another authentication method (or apply a workaround we provide if they cannot do either of the above immediately). Important to stress, because many of the users might get confused by the name, OpenID is NOT the same as OpenID Connect. Those are completely different protocols and while OpenID Connect (also known as OIDC) is a modern, widely used protocol, OpenID is a legacy protocol that has been deprecated more than 10 years ago and since then has been abandoned by almost everyone in the community, including all services in Flask AppBuilder example services that supported it, so it is highly unlikely someone is still using it. Due to this highly unlikely configuration the Flask AppBuilder CVE is just "Moderate" not "Critical". It affects a very small (if any) number of users and it's not likely to be a target for an attack. However, we still advise our users who still use AUTH_OID to apply remediation. This vulnerability is fixed in Flask Appbuilder 4.3.11 and Apache Airflow 2.8.2 uses that version of Flask Application Builder. We advise users who still use this authentication method to either switch to a