CVE-2026-73084: Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can break out of the script context and execute arbitrary JavaScript in the Activepieces origin when a logged-in user opens it. An unauthenticated attacker can access the victim's session tokens or make authenticated API calls on the victim's behalf. This issue is fixed in version 0.83.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Activepieces (/api/redirect OAuth callback endpoint)to a version that resolves this vulnerability.Fixed in 0.83.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73084?
The severity of CVE-2026-73084 is medium with a score of 6.1.
What type of vulnerability is CVE-2026-73084?
CVE-2026-73084 is a reflected cross-site scripting (XSS) vulnerability.
How does CVE-2026-73084 affect users?
CVE-2026-73084 can allow attackers to inject malicious scripts into the OAuth redirect endpoint, potentially compromising user data.
How do I fix CVE-2026-73084?
To fix CVE-2026-73084, upgrade to Activepieces version 0.83.0 or later, where the issue has been addressed.
Is CVE-2026-73084 related to code injection?
Yes, CVE-2026-73084 involves code injection vulnerabilities through unsanitized user input.