CVE-2026-25956
📋 TL;DR
This vulnerability allows attackers to craft malicious signup URLs for Frappe sites, which can lead to open redirects or reflected cross-site scripting (XSS) attacks when users sign up. It affects all Frappe framework users running versions before 14.99.14 or 15.94.0. The attacker can potentially steal user credentials or redirect users to malicious sites.
💻 Affected Systems
- Frappe Framework
📦 What is this software?
Frappe by Frappe
Frappe by Frappe
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal user session cookies, credentials, or redirect users to phishing sites, potentially leading to account compromise and data theft.
Likely Case
Attackers would typically use this for phishing campaigns or session hijacking by redirecting users to malicious sites.
If Mitigated
With proper input validation and output encoding, the impact would be limited to failed exploitation attempts.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link) but is straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.99.14 or 15.94.0
Vendor Advisory: https://github.com/frappe/frappe/security/advisories/GHSA-7m8v-g2pr-h2f7
Restart Required: Yes
Instructions:
1. Update Frappe to version 14.99.14 (for v14) or 15.94.0 (for v15). 2. Restart the Frappe application server. 3. Verify the fix by testing signup functionality.
🔧 Temporary Workarounds
Disable User Signup
allTemporarily disable user self-registration functionality to prevent exploitation.
bench set-config allow_signup false
Input Validation Filter
allAdd custom validation to sanitize signup URL parameters.
Add URL validation in signup controller to reject suspicious redirect parameters
🧯 If You Can't Patch
- Implement WAF rules to block malicious redirect parameters in signup URLs
- Deploy browser security headers like Content-Security-Policy to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check Frappe version using bench version command and compare against vulnerable versions.Check Version:
bench versionVerify Fix Applied:
Test signup functionality with crafted URLs containing redirect parameters to ensure they're properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual signup attempts with URL parameters containing redirects or script tags
- Multiple failed signup attempts from same IP
Network Indicators:
- HTTP requests to signup endpoint with suspicious redirect parameters
- Outbound redirects to external domains after signup
SIEM Query:
source="frappe_logs" AND (url="*/api/method/frappe.www.login.sign_up*" AND (url="*redirect=*" OR url="*script*"))