Affected: PyPI: flask-appbuilder

### Impact User enumeration in database authentication in Flask-AppBuilder <= 4.5.3 and werkzeug >= 3.0.0. Allows for a non authenticated user to enumerate existing usernames by timing the response time from the server when brute forcing requests to login.

### Patches

Upgrade to flask-appbuilder>=4.5.3

### Workarounds Downgrade werkzeug to <3.0.0

### References _Are there any links users can visit to find out more?_