Is Flask-User safe to use?

Flask-User has 2 known vulnerabilities on the latest version (1.0.2.2). DepScope rates its health at 40/100 (high risk).

What is the latest version of Flask-User?

The latest version of Flask-User is 1.0.2.2, released 2019-11-30.

Does Flask-User have known vulnerabilities?

Yes. Flask-User has 2 known vulnerabilities. See depscope.dev/pkg/pypi/Flask-User for details.

Is Flask-User deprecated?

No, Flask-User is actively maintained. Latest release: 1.0.2.2 (2019-11-30).

What are alternatives to Flask-User?

Popular alternatives to Flask-User in PyPI include: boto3, packaging, urllib3, idna, typing-extensions.

What license does Flask-User use?

Flask-User is licensed under MIT.

Flask-User

pypiv1.0.2.2

Customizable User Authentication & User Management: Register, Confirm, Login, Change username/password, Forgot password and more.

License MITpermissive53 versions1 maintainers0 deps

lingthio/Flask-User

/ 100

Health

safe to use

[email protected] is safe to use (health: 40/100)

Health breakdown0 – 100

0/25

maintenance

0/20

popularity

23/25

security

15/15

maturity

2/15

community

Vulnerabilities

1 medium1 low

Advisories (2)

Severity	ID	Summary	Fixed in
medium	CVE-2021-23401	Open Redirect in Flask-User	—
unknown	CVE-2021-23401	This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as /////evil.com/path or \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.	—

Health History

Dependency Tree

License Audit

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/pypi/Flask-User