CVE-2026-47194 in Frappe
Summary
by MITRE • 08/07/2026
Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token when a recipient follows the link. This issue is fixed in versions 15.108.0 and 16.18.3.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability affects the Frappe web application framework where temporary magic login links are generated with potentially malicious host headers. The flaw allows remote attackers to manipulate the Host header during link generation, causing emailed login tokens to direct users to attacker-controlled domains instead of the legitimate application server. This represents a critical security risk as it enables credential interception and unauthorized access to user accounts through social engineering attacks.
The technical implementation involves the framework's handling of HTTP request headers during authentication flow. When generating magic login links, the system fails to properly validate or sanitize the Host header value that originates from the incoming HTTP request. This creates an open redirect vulnerability where attacker-controlled domains can be injected into the generated URLs, making it possible to capture valid authentication tokens when users click on compromised links.
The operational impact of this vulnerability spans multiple attack vectors within the web application security landscape. An attacker could craft malicious login emails with forged URLs pointing to phishing domains that mimic legitimate application interfaces. When users click these links and authenticate, their session tokens are transmitted to the attacker-controlled domain rather than the legitimate server. This enables account takeover attacks and potentially broader system compromise.
This vulnerability aligns with CWE-601 Open Redirect and CWE-352 Cross-Site Request Forgery categories, representing a significant weakness in the application's input validation mechanisms. The issue also maps to ATT&CK technique T1566 Phishing within the initial access phase, as it enables attackers to create convincing authentication interception scenarios. Additionally, the vulnerability demonstrates weaknesses in secure header handling and proper URL construction practices.
Mitigation strategies should focus on implementing strict validation of Host headers during authentication flow, ensuring that generated URLs only reference legitimate application domains. Organizations should enforce proper input sanitization and utilize secure default configurations for HTTP headers. The recommended solution involves updating to Frappe versions 15.108.0 or 16.18.3 where the vulnerability has been patched through improved header validation and URL construction logic that prevents attacker-controlled domains from being incorporated into generated magic links.