A flaw exists in Frappe’s login link generation process that allows the Host header supplied by an attacker to be reflected in the magic login link email. When this link is followed by a user, the login token is delivered to an attacker‑controlled domain, enabling credential capture. The weakness is a form of host header poisoning identified as CWE-346. The result is a loss of both confidentiality and integrity of user accounts, as attackers can control the redirection path and subsequently log in with the stolen token.

The affected product is Frappe, an open‑source full‑stack web framework. Any installation using a version earlier than 15.108.0 or 16.18.3 is vulnerable. These installs lack the necessary protection against supply of a forged Host header during temporary magic link creation.

The CVSS score of 8.6 indicates high severity. EPSS is currently unavailable, but the vulnerability is listed as not part of CISA’s KEV catalog, suggesting that known exploits have not been publicly observed. A remote attacker can exploit this via any HTTP request to the web application, supplying a crafted Host header. If a legitimate user follows the resulting magic link, the attacker receives the login token, effectively granting them account access. Given the lack of a public exploit, the immediate risk relies on the attacker’s ability to persuade or manipulate a user into clicking a malicious link or have an email client automatically treat the link as safe.