Frappe Open Redirect Vulnerability on Login Page

An open redirect vulnerability has been identified in the Frappe web application framework, affecting versions prior to 14.98.0 and 15.83.0. The issue arises on the login page, where the redirect argument could be manipulated to redirect users to an external URL, given a specific type of URL was provided. This vulnerability requires user interaction to exploit.

Impact

Exploitation of this vulnerability allows for open redirect, where users can be redirected to an external site of the attacker's choosing.

Remediation

Users are advised to upgrade to Frappe versions 14.98.0 or 15.83.0, where this vulnerability has been patched.