Executive brief
Frappe is a popular web application framework used to build business applications. A vulnerability in its temporary login link feature allows attackers to manipulate the links sent to users via email, redirecting them to attacker-controlled websites. When users click these compromised links, their authentication tokens are captured by the attacker, leading to account takeover and unauthorized access to sensitive application data.
Technical details
This is a host header poisoning vulnerability in the magic login link generation mechanism of Frappe. The framework fails to validate the Host header during temporary login link creation, allowing an attacker to inject a malicious hostname that gets embedded in the emailed link. The vulnerability requires no authentication and is exploitable by any network-adjacent attacker who can make requests to the Frappe application (e.g., via HTTP request injection or proxy manipulation). When users receive the poisoned link and follow it, their login tokens are sent to the attacker's domain instead of the legitimate application. The issue is fixed in Frappe versions 15.108.0 and 16.18.3.
Affected products
- Frappe Frappe prior to 15.108.0 and prior to 16.18.3
Timeline
- 2026-07-14: disclosed
- 2026-08-06: advisory: NVD published
- 2026-07-14: patched: Versions 15.108.0 and 16.18.3 released