high8.6
CVE-2026-47194
Frappe is a full-stack web application framework.
Impact
Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token when a recipient follows the link. This issue is fixed in versions 15.108.0 and 16.18.3.
Affected products
| Product | Affected versions |
|---|---|
| Frappe Is A Full-Stack Web Application Framework. | before 15.108.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.