Frappe Framework CVE-2026-66057

The affected Frappe instance must have OAuth / social login configured and enabled (the frappe.utils.oauth login_via_oauth2 flow), and the attacker must deliver a crafted OAuth login link to a victim who then clicks it and completes authentication at the provider - exploitation cannot occur passively or against instances without social login. Key limiting factors: required active user interaction (UI:A), dependency on the OAuth login feature being in use, impact restricted to redirection (no code execution, data write, or availability loss), and applicability only to versions prior to 15.116.0 (v15 line) and 16.29.0 (v16 line).

This is a genuine but modest-severity issue, best treated as routine patch-cycle work rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, 5.1 Medium) correctly captures the shape of a CWE-601 open redirect: network-reachable, low complexity, no attacker privileges, but requiring active victim interaction and yielding only low confidentiality impact with no integrity or availability effect. No EPSS score was provided in the input, and the CVE is NOT present in CISA KEV, so there is no evidence of active exploitation. The 'Source code evidence' is the vendor fix (PR #40962 and associated commits), not a weaponized exploit, so this should not be mistaken for public POC exploit code. The signals are internally consistent - a network open redirect gated behind user interaction and a configured OAuth flow - so there is no CVSS-versus-description conflict. The realistic danger is phishing/credential-harvesting amplification (a trusted Frappe domain bouncing users to an attacker site post-login) rather than direct system compromise; prioritize for the next maintenance window, with urgency raised only if the instance exposes OAuth/social login to untrusted users.

An attacker crafts a Frappe OAuth login URL containing a malicious client-controlled state value and sends it to a victim via phishing. After the victim authenticates through the legitimate OAuth provider, the application uses the unsanitized state to navigate them to an attacker-chosen external location, lending the attacker's landing page the credibility of the trusted Frappe domain. No public exploit code was identified at time of analysis, and the network vector with low complexity makes the link trivial to construct, but success depends on the victim clicking and completing login.