Executive brief
Frappe is a popular open-source web framework used to build business applications. An OAuth2 authorization vulnerability allows attackers to trick authenticated users into granting unauthorized access to their accounts or reuse authorization tokens for the wrong application, potentially exposing sensitive data and enabling unauthorized actions on behalf of the compromised account.
Technical details
The vulnerability exists in frappe/integrations/oauth2.py where the approve and authorize functions lack proper security controls. Specifically: (1) the approve endpoint accepts GET requests instead of POST-only, enabling attackers to craft malicious links; (2) the OAuth confirmation template lacks a CSRF token, allowing cross-site request forgery; and (3) the authorization token validation does not restrict tokens to the requesting OAuth client, permitting token reuse across clients. An authenticated user can be tricked via a crafted link to approve an OAuth grant for an attacker-controlled application, or an attacker can reuse authorization state/tokens between clients. The vulnerability was patched in versions 15.114.0 and 16.26.0 by restricting approve to POST, adding CSRF tokens to the confirmation template, and hardening the token validation logic.
Affected products
- Frappe Frappe before 15.114.0 and before 16.26.0
Timeline
- 2026-08-20: disclosed
- 2026-08-20: patched: Fixed in versions 15.114.0 and 16.26.0