Open Redirect and Reflected XSS Vulnerability in Frappe Web Application Framework

CVE-2026-25956

What is CVE-2026-25956?

The Frappe Web Application Framework is susceptible to a security flaw that allows attackers to create malicious signup URLs. This vulnerability can result in either an open redirect or reflected XSS attacks, depending on the malicious payload used. Users signing up on a compromised Frappe site may inadvertently expose themselves to these threats. The issue has been addressed in version 14.99.14 and 15.94.0, providing critical updates for users to ensure their applications are secure.

References