Open Redirect and Reflected XSS Vulnerability in Frappe Web Application Framework

CVE-2026-25956

What is CVE-2026-25956?

The Frappe Web Application Framework is susceptible to a security flaw that allows attackers to create malicious signup URLs. This vulnerability can result in either an open redirect or reflected XSS attacks, depending on the malicious payload used. Users signing up on a compromised Frappe site may inadvertently expose themselves to these threats. The issue has been addressed in version 14.99.14 and 15.94.0, providing critical updates for users to ensure their applications are secure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References