This flaw allows an attacker to craft a malicious value for the code query parameter in the /api/redirect OAuth callback, which is embedded directly into a script block without sanitization. The result is a reflected cross‑site scripting vulnerability that can execute arbitrary JavaScript in the browser context of any logged‑in user who follows the redirect. The injected code can read or steal the victim’s session tokens or perform authenticated API calls under the victim’s credentials, compromising confidentiality, integrity, and availability of the user’s data within the Activepieces platform. This issue is classified as CWE‑79 and CWE‑94.

All installations of the open‑source Activepieces workflow automation platform with a version earlier than 0.83.0 are affected. The vulnerability resides in the /api/redirect endpoint and applies to any deployment that has not applied the 0.83.0 fix.

The attack vector is inferred from the description to be remote user‑interaction with the OAuth redirect endpoint. Because the vulnerability is triggered only when a logged‑in user opens the crafted URL, a social engineering or phishing campaign can be effective. The low EPSS score suggests that, although the technical risk is moderate, the probability of it being exploited in the near term is low, yet it remains important to mitigate the flaw promptly. The CVSS score is 6.1, indicating moderate severity.