CVE-2026-66057
Deferred Deferred - Pending Action

Open Redirect in Frappe Framework

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fixed in versions 15.116.0 and 16.29.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-66057
EUVD
EUVD-2026-98927

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
frappe frappe < 15.116.0
frappe frappe >= 16.0.0, < 16.29.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in Frappe versions before 15.116.0 and 16.29.0 involves the OAuth login flow using an unsanitized client-controlled state parameter. This allows an attacker to manipulate the post-authentication navigation by injecting a crafted state value, redirecting users to a malicious location.

Impact Analysis

This vulnerability could allow attackers to redirect users to phishing sites or malicious pages after OAuth login, potentially leading to credential theft, session hijacking, or further exploitation of user accounts.

Mitigation Strategies

Update Frappe to version 15.116.0 or later if using Frappe 15.x, or to version 16.29.0 or later if using Frappe 16.x. This fixes the unsanitized state parameter in the OAuth login flow.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66057. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart