Krupalvora

**Name of the Vulnerable Software and Affected Versions** Frappe Framework versions prior to 15.120.0 Frappe Framework versions 16.x prior to 16.33.0 **Description** The software fails to enforce the per-user `restrict ip` allowlist for non-session authentication methods. This includes API key, OAuth, and header-based authentication. An attacker with valid credentials for these methods can authenticate from IP addresses that are not on the allowlist, bypassing network-based access restrictions. **Recommendations** Update to version 15.120.0 or later. Update to version 16.33.0 or later.