What’s Vulnerable › Vulnerabilities
CVE-2026-47194: Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain
- Severity: high (CVSS 8.6 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-06 · updated 2026-09-08
- Weakness: CWE-346
Description
Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token when a recipient follows the link. This issue is fixed in versions 15.108.0 and 16.18.3.
Affected products
- frappe: from 16.0.0-beta.1, < 16.18.3; before 15.108.0
References
Get alerted when CVE-2026-47194 or the next vulnerability affects your stack