CVE-2026-66057 Details
Description
Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fixed in versions 15.116.0 and 16.29.0.
An open redirect vulnerability has been identified in the Frappe web application framework, specifically in versions prior to 15.116.0 and 16.29.0. The issue arises in the OAuth login flow, where an unsanitized client-controlled state parameter is used to determine post-authentication navigation. This allows a crafted state value to redirect users to an attacker-chosen location.
Users can update to Frappe versions 15.116.0 or 16.29.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/frappe/frappe/commit/12568e2d54c4abba70bc0261387053fa28f90988 | [email protected] | Source CodeVendor |
| https://github.com/frappe/frappe/commit/1e0a3b941231d74a71ff1a43eee2e9f63c88712d | [email protected] | Source CodeVendor |
| https://github.com/frappe/frappe/commit/6ed8acd869199feb3a2598887d471448297edf07 | [email protected] | Source CodeVendor |
| https://github.com/frappe/frappe/pull/40962 | [email protected] | Source CodeVendor |
| https://github.com/frappe/frappe/releases/tag/v15.116.0 | [email protected] | Release NotesVendor |
| https://github.com/frappe/frappe/releases/tag/v16.29.0 | [email protected] | Release NotesVendor |
| https://github.com/frappe/frappe/security/advisories/GHSA-78c5-55xg-jm7m | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Frappe | < 16.29.0 (semver) < 15.116.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |