CVE-2026-66057— Frappe: Open Redirect via Unsanitized OAuth State Param.
Quick assessment
Affected
frappe frappe
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Frappe 是一个全栈 Web 应用框架。在 15.116.0 和 16.29.0 版本之前，OAuth 登录流程使用未经处理的客户端控制的 state 参数来选择认证后的导航路径，攻击者可以通过构造特定的 state 值将用户重定向到其指定的恶意位置。该问题已在 15.116.0 和 16.29.0 版本中得到修复。
Possible ATT&CK Techniques 1 AI
T1566.002 · Spearphishing Link
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66057
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe: Open Redirect via Unsanitized OAuth State Param.
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fixed in versions 15.116.0 and 16.29.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-66057
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66057
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-66057 (5)
-
-
🔗 Release v15.116.0 · frappe/frappe · GitHub x_refsource_MISC
-
-
-
Vendor Advisories for CVE-2026-66057 (1)
Vendor Pages for CVE-2026-66057 (1)
-
🔗 Release v16.29.0 · frappe/frappe · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: frappe
-
CVE-2026-55823
Frappe: Possibility of SQL injection in reportview -
CVE-2026-109603
Frappe Framework before 16.17.0 Authenticated SSRF and LFI v -
CVE-2026-109602
Frappe before v16.31.0 Stored XSS via Dashboard Chart Filter -
CVE-2026-109600
Frappe before 16.31.0 Improper Access Control in Document Fo -
CVE-2026-109601
Frappe Framework before v16.30.0 Arbitrary File Read via Out
Same vendor: frappe
-
CVE-2026-55823
Frappe: Possibility of SQL injection in reportview -
CVE-2026-109675
Frappe Suite before commit 2697564 Broken Access Control in -
CVE-2026-109674
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input -
CVE-2026-109672
Frappe ERPNext before 15.118.0 Missing Authorization Exposes -
CVE-2026-109673
Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record
Same weakness: CWE-601
-
CVE-2026-107369
Improper Validation of Post-Login Redirect URL in nextjs-aut -
CVE-2026-103576
Active Directory Federation Services (AD FS) Spoofing Vulner -
CVE-2026-83646
Active Directory Federation Services (AD FS) Spoofing Vulner -
CVE-2026-83500
Windows BitLocker Security Feature Bypass Vulnerability -
CVE-2026-109160
PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigCo
V. Comments for CVE-2026-66057
No comments yet