CVE-2026-73084 in Activepieces
Summary
by MITRE • 08/12/2026
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can break out of the script context and execute arbitrary JavaScript in the Activepieces origin when a logged-in user opens it. An unauthenticated attacker can access the victim's session tokens or make authenticated API calls on the victim's behalf. This issue is fixed in version 0.83.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability identified in Activepieces prior to version 0.83.0 represents a critical cross-site scripting flaw that exploits improper input validation in the OAuth callback endpoint. This weakness occurs within the /api/redirect path where user-supplied parameters are directly incorporated into inline JavaScript code blocks without adequate sanitization or escaping mechanisms. The flaw specifically affects the code query parameter handling, creating an environment where malicious actors can inject arbitrary JavaScript code that executes within the context of legitimate user sessions.
This vulnerability falls under the CWE-79 category for Cross-Site Scripting and aligns with ATT&CK technique T1566.001 for Phishing through Social Engineering. The security flaw enables attackers to perform session hijacking by injecting malicious JavaScript that can extract session tokens or make authenticated API calls on behalf of victims. When a logged-in user visits the crafted URL containing the malicious code parameter, the injected script executes in their browser context, effectively compromising their session and granting unauthorized access to the platform's resources.
The technical exploitation requires an attacker to craft a malicious request to the vulnerable endpoint with a specially formatted code parameter that breaks out of the intended script context. This allows for arbitrary JavaScript execution within the Activepieces origin domain, bypassing typical security boundaries that protect against cross-origin attacks. The vulnerability is particularly dangerous because it leverages legitimate user sessions, making it difficult to detect and trace back to the actual attacker.
The impact extends beyond simple XSS exploitation as it enables full session compromise and potential data exfiltration or modification of user data. An attacker can leverage this vulnerability to access sensitive information, modify workflows, or perform unauthorized operations within the Activepieces platform. The fix implemented in version 0.83.0 addresses this by properly escaping or sanitizing user-supplied input before incorporating it into script contexts, preventing the injection of malicious code that could compromise user sessions or execute unauthorized operations.
Organizations using Activepieces should immediately upgrade to version 0.83.0 or later to mitigate this vulnerability. Additionally, security monitoring should be implemented to detect any suspicious activity related to OAuth callback endpoints, and regular security audits should verify proper input validation mechanisms are in place across all application components handling user-supplied data. The vulnerability demonstrates the critical importance of proper input sanitization and context-aware escaping in web applications, particularly those handling authentication flows and session management.