Vulnerability Report

CVE-2026-25956

Title: Open redirect/reflected XSS in Frappe signup URL

XSS

Proof Of Concept

No public PoC currently indexed for CVE-2026-25956.

CWE Category CWE-79

Published Date Feb 10, 2026

Modified Date Feb 17, 2026

Exploit Status Not Found

Score 6.1 CVSS v3.1

Exploit Probability (EPSS)

0.16%

Vulnerability Summary

CVE-2026-25956: Frappe is a full-stack web application framework. Prior to 14.99.14 and 15.94.0, an attacker could craft a malicious signup URL for a frappe site which could lead to an open redirect (or reflected XSS, depending on the crafted payload) when a user signs up. This vulnerability is fixed in 14.99.14 and 15.94.0.

Impacted Vendors

frappe 1

Reference Links

https://github.com/frappe/frappe/commit/22cac9dd240dc1fa00d4bab7e3887b70faf22bd1 https://github.com/frappe/frappe/security/advisories/GHSA-7m8v-g2pr-h2f7

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

6.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-25956 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

February 17, 2026 MODIFIED

Vulnerability data updated via NVD.

February 17, 2026 MODIFIED

Vulnerability data updated via NVD.

February 10, 2026 MODIFIED

Vulnerability data updated via NVD.

February 10, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction REQUIRED

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected Stack

No specific products linked.