The Frappe framework contains a flaw that allows an attacker to construct a special sign‑up URL. When a user follows the link during registration, the browser may be redirected to an attacker‑chosen site or may execute a reflected cross‑site scripting payload. The vulnerability is linked to CWE‑79 (XSS) and CWE‑601 (Open Redirect).

Any installation of the Frappe framework built prior to version 14.99.14 or 15.94.0 is affected. The issue arises in the public framework through its sign‑up functionality, affecting all sites that use the default registration flow without additional safeguards.

The CVSS score of 6.1 classifies the issue as Medium severity. The EPSS score is below 1%, indicating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to craft a malicious link and convince a user to click on it during the sign‑up process. This suggests that successful exploitation depends on user interaction, which may limit the threat surface but still permits redirect or scripting attacks when the user follows the link.