CVE-2026-66057: Frappe: Open Redirect via Unsanitized OAuth State Param.
Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fixed in versions 15.116.0 and 16.29.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 15.116.0 - Upgrade
Upgrade
Frappeto a version that resolves this vulnerability.Fixed in 16.29.0
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe deployments running versions earlier than 15.116.0 or 16.29.0 are affected.
What must an attacker do to exploit this issue?
An attacker must craft an OAuth login flow with a malicious client-controlled state value. After authentication, that value can cause the user to be redirected to an attacker-chosen location.
How can the issue be remediated?
Upgrade Frappe to version 15.116.0 or 16.29.0, which contain the fix.