CVE-2026-66001

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 15.114.0 Frappe versions prior to 16.26.0

Description Improper authorization in the OAuth2 consent flow allows the approve() and authorize() functions in frappe/integrations/oauth2.py to proceed without restricting the approve action to POST requests. Additionally, the frappe/templates/includes/oauth confirmation.html file lacks a csrf token (Cross-Site Request Forgery token, a unique value used to prevent unauthorized commands from being transmitted from a user that the web application trusts), and active OAuth token checks are not scoped to the requesting client. This enables an attacker to trick an authenticated user into approving an OAuth grant or reusing authorization state for an incorrect client, potentially exposing data and allowing unauthorized actions within the granted scopes.

Recommendations Update to version 15.114.0. Update to version 16.26.0.