CVE-2026-66001 — OAuth2 Consent Bypass in Frappe Framework
Summary Field Value CVE ID CVE-2026-66001 Advisory GHSA-2ph8-x773-8p2x Vulnerability Type OAuth2 Consent Bypass / Cross-Site Request Forgery CWE CWE-352: Cross-Site Request Forgery Attack Vector Network CVSS v4.0 Base Score 8.5 (High) CVSS v4.0 Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Affected Versions Frappe < 15.114.0; 16.0.0-beta.1 through 16.25.x Patched Versions 15.114.0 and 16.26.0 Publicly Credited Reporters DerekHaber and Mohammed Alzahrani (mzalzahrani) Remediation Developer AarDG10 Executive Summary Frappe Framework contained an improper authorization weakness in its OAuth2 consent flow. In the attack path I validated, an unauthenticated attacker could register an OAuth client when Dynamic Client Registration was enabled, then direct a logged-in victim to the OAuth approval endpoint. The vulnerable endpoint could issue an authorization code and redirect it to the attacker’s registered callback without requiring the victim to complete the expected consent confirmation. ...