Frappe’s OAuth login flow improperly uses a client‑controlled state parameter without sanitization, permitting an attacker to craft a redirect URL that will be executed once authentication succeeds. This results in an open redirect, allowing malicious sites to be delivered to users after login and potentially facilitating phishing or click‑jacking attacks. The weakness is classified as CWE‑601.

The vulnerability affects the Frappe web application framework. Versions prior to 15.116.0 and 16.29.0 are impacted; the flaw was addressed in those releases and newer versions.

The CVSS score is 5.1, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the weakness by initiating an OAuth authentication request with a forged state value that points to an arbitrary URL; the victim’s browser will then redirect to the attacker‑controlled site after successful authentication.