CVE-2025-62407: Frappe Open Redirect Vulnerability

CVE-2025-62407 Overview

CVE-2025-62407 is an open redirect vulnerability in the Frappe full-stack web application framework. The flaw affects versions prior to 14.98.0 and 15.83.0. Attackers can abuse the redirect argument on the login page when a specific URL format is supplied. This allows redirection to attacker-controlled destinations after authentication, enabling phishing and credential theft scenarios. The issue is tracked under CWE-601: URL Redirection to Untrusted Site. Frappe addressed the issue in versions 14.98.0 and 15.83.0.

Critical Impact
Attackers can craft malicious login URLs that redirect authenticated users to attacker-controlled sites, facilitating phishing campaigns and credential harvesting against Frappe and ERPNext deployments.

Affected Products

Frappe Framework versions prior to 14.98.0 (14.x branch)
Frappe Framework versions prior to 15.83.0 (15.x branch)
Downstream applications built on Frappe, including ERPNext deployments

Discovery Timeline

2025-10-16 - CVE-2025-62407 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62407

Vulnerability Analysis

The vulnerability resides in Frappe's login page handling of the redirect query parameter. Frappe accepts a post-authentication redirect target through this argument. The validation logic fails to properly reject certain URL formats that point to external, attacker-controlled domains. An attacker crafts a login URL that includes a malicious redirect value and lures a victim to click it. After the victim authenticates, or in some flows even before, the application forwards the browser to the attacker's destination.

Because the initial hostname is the trusted Frappe instance, users are more likely to trust the link. This trust is then transferred to a phishing page that mimics the original application. Attackers commonly use such flows to harvest credentials, deliver malware downloads, or stage OAuth consent phishing.

Root Cause

The root cause is insufficient validation of user-controlled input passed to the redirect parameter on the login endpoint. The framework did not enforce that the redirect target belonged to an allowlisted origin or a same-site path. Specific URL formats bypassed existing sanitization checks, permitting arbitrary external destinations.

Attack Vector

Exploitation requires network access to the target Frappe instance and user interaction. An attacker distributes a crafted URL through email, chat, or social media. The URL points to the legitimate Frappe login page and includes a malicious redirect parameter. When the victim follows the link and completes login, the browser is redirected to the attacker-controlled site. No authentication or elevated privileges are required from the attacker to construct the payload.

The vulnerability mechanism is described in the Frappe GitHub Security Advisory GHSA-j9jr-qrpj-g855. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2025-62407

Indicators of Compromise

HTTP requests to /login or authentication endpoints containing a redirect query parameter whose value references an external domain.
Referrer logs showing external domains following authentication events on the Frappe host.
User reports of unexpected redirection to unfamiliar sites after logging in to Frappe or ERPNext.

Detection Strategies

Inspect web server access logs for login requests containing redirect= parameters with URL-encoded schemes, protocol-relative URLs, or fully qualified external hostnames.
Deploy web application firewall rules to flag or block outbound redirects to domains outside the organization's allowlist.
Correlate authentication events with subsequent HTTP 302 responses that carry a Location header pointing to third-party domains.

Monitoring Recommendations

Enable verbose logging on the Frappe authentication endpoints and forward logs to a centralized SIEM for correlation.
Alert on anomalous spikes in login requests carrying the redirect parameter, particularly from external referrers.
Monitor phishing intelligence feeds for lookalike domains referencing the organization's Frappe or ERPNext URLs.

How to Mitigate CVE-2025-62407

Immediate Actions Required

Upgrade Frappe to version 14.98.0 on the 14.x branch or 15.83.0 on the 15.x branch.
Audit web server and application logs for suspicious redirect parameter values over the past 90 days.
Notify users of the phishing risk and reinforce guidance to verify destination URLs after login.

Patch Information

Frappe has released fixed versions 14.98.0 and 15.83.0 that properly validate the redirect argument on the login page. Refer to the Frappe GitHub Security Advisory GHSA-j9jr-qrpj-g855 for full remediation details and upgrade instructions.

Workarounds

If immediate patching is not possible, place a reverse proxy or WAF rule in front of Frappe to strip or validate the redirect parameter on login endpoints.
Restrict acceptable redirect destinations to a hardcoded allowlist of internal paths.
Disable or remove the redirect functionality on the login page until the upgrade is applied.

bash

# Example: nginx rule to block external redirect values on the login page
location /login {
    if ($arg_redirect ~* "^(https?:)?//") {
        return 400;
    }
    proxy_pass http://frappe_backend;
}