OAuth Login Vulnerability in Frappe Framework by Frappe Technologies

CVE-2026-66057

What is CVE-2026-66057?

The Frappe Framework, utilized for building web applications, has a security flaw in its OAuth login process. Specifically, prior to versions 15.116.0 and 16.29.0, the system allows the inclusion of an unsanitized client-controlled state parameter. This parameter can be exploited by malicious actors to craft a state value that redirects users to undesired locations following authentication. This vulnerability poses a significant risk to user navigation and data integrity, thus it is essential to upgrade to the specified versions to mitigate such threats.

References