CVE-2026-66001
Received Received - Intake

OAuth2 Consent Flow Misuse in Frappe Framework

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrf_token in frappe/templates/includes/oauth_confirmation.html, and without scoping an active OAuth token check to the requesting client. An attacker can cause an authenticated user to approve an OAuth grant or reuse authorization state for the wrong client, exposing data and permitting actions within the granted scopes. This issue is fixed in versions 15.114.0 and 16.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-66001
EUVD
EUVD-2026-63540

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
frappe frappe 15.114.0
frappe frappe 16.26.0
frappe frappe to 15.114.0 (exc)
frappe frappe to 16.26.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Frappe framework versions before 15.114.0 and 16.26.0 allows attackers to manipulate OAuth consent flows. The approve and authorize functions lack proper security controls like POST-only requests, CSRF tokens, and client-specific token checks. This could let an attacker trick authenticated users into approving OAuth grants for unintended clients or reuse authorization states incorrectly.

Detection Guidance

Check if your Frappe instance is running a vulnerable version (prior to 15.114.0 or 16.26.0) by running: grep -r 'version' /path/to/frappe | grep -E '15\.(1[0-9]|[0-9]{2})\.[0-9]+|16\.(1[0-9]|2[0-5])\.[0-9]+'

Inspect OAuth endpoints for improper CSRF protection by reviewing frappe/integrations/oauth2.py and frappe/templates/includes/oauth_confirmation.html for POST-only approval and CSRF token inclusion.

Impact Analysis

If exploited, this vulnerability could expose your data and allow unauthorized actions within granted OAuth scopes. Attackers might gain access to sensitive information or perform actions on your behalf without consent. Systems using Frappe framework versions prior to 15.114.0 or 16.26.0 are at risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or actions, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance risks include fines, legal penalties, and reputational damage due to potential data breaches or improper access controls.

Mitigation Strategies

Upgrade Frappe to version 15.114.0 or 16.26.0 or later immediately to apply the security patches for OAuth endpoints.

Review and update OAuth configurations to ensure approve actions are restricted to POST requests and CSRF tokens are included in authorization flows.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66001. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart