CyberRota Analysis
AI-GeneratedFrappe versions prior to 15.108.0 and 16.18.3 are vulnerable to an attack that exploits the request Host header, enabling attackers to generate malicious login links that redirect users to an attacker-controlled domain. This vulnerability can lead to unauthorized access by capturing login tokens when users follow the compromised links. Organizations using affected versions should prioritize updating to the patched releases to mitigate the risk of credential theft and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token when a recipient follows the link. This issue is fixed in versions 15.108.0 and 16.18.3.