CVE-2026-73084: Activepieces OAuth Callback XSS Vulnerability

CVE-2026-73084 Overview

CVE-2026-73084 is a reflected cross-site scripting (XSS) vulnerability in Activepieces, an open source AI workflow automation platform. The /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline <script> block without proper escaping. An attacker who convinces a logged-in user to open a crafted URL can break out of the script context and execute arbitrary JavaScript within the Activepieces origin. Successful exploitation grants access to the victim's session tokens and enables authenticated API calls on the victim's behalf. The issue is fixed in version 0.83.0 and is categorized under CWE-79.

Critical Impact
An unauthenticated attacker can hijack the session of any logged-in Activepieces user who opens a crafted /api/redirect URL, enabling account takeover and workflow tampering.

Affected Products

Activepieces versions prior to 0.83.0
Self-hosted Activepieces deployments exposing the /api/redirect OAuth callback
Managed Activepieces instances running unpatched builds

Discovery Timeline

2026-08-11 - CVE-2026-73084 published to NVD
2026-08-12 - Last updated in NVD database
0.83.0 - Activepieces releases patched version incorporating Mustache-based templating for the redirect endpoint

Technical Details for CVE-2026-73084

Vulnerability Analysis

The vulnerability resides in the OAuth callback handler exposed at /api/redirect. The server reads the code query parameter and interpolates it directly into an inline JavaScript block returned in the HTML response. Because no HTML or JavaScript escaping is applied, an attacker can supply a code value containing closing tag sequences such as </script> or JavaScript string terminators. The injected payload then executes in the browser under the Activepieces origin. Since the endpoint requires no authentication to render, an attacker only needs to deliver the crafted link to a logged-in victim. Once the script runs, it can read session cookies not marked HttpOnly, extract tokens from local storage, and issue authenticated requests to the Activepieces API.

Root Cause

The root cause is unsafe string concatenation of untrusted input into a JavaScript context. The redirect handler treats the code parameter as a trusted string when constructing the response body, violating the principle that user-controlled data must be encoded per the output context. The upstream fix replaces manual concatenation with the Mustache templating library, which applies context-aware escaping when rendering values into the response.

Attack Vector

An unauthenticated attacker crafts a URL of the form https://<target>/api/redirect?code=<payload> and delivers it via phishing, chat, or an embedded link. When a logged-in Activepieces user opens the link, the browser renders the response and executes the payload in the application origin. User interaction is required, consistent with the CVSS UI:R scope-changing profile.

typescript

// Patch excerpt from packages/server/api/src/app/app.ts
// fix: use mustache for redirect endpoint
 import swagger from '@fastify/swagger'
 import { createAdapter } from '@socket.io/redis-adapter'
 import { FastifyInstance, FastifyRequest, HTTPMethods } from 'fastify'
+import Mustache from 'mustache'
 import { agentsModule } from './agents/agents-module'
 import { aiProviderService } from './ai/ai-provider-service'
 import { aiProviderModule } from './ai/ai-provider.module'

Source: Activepieces commit 8be4c8d

Detection Methods for CVE-2026-73084

Indicators of Compromise

Requests to /api/redirect with unusually long code values or containing characters such as <, >, ", ', or the substring </script>.
Outbound requests from user browsers to attacker-controlled domains immediately after visits to /api/redirect.
Authenticated API activity originating from IP addresses or user agents that do not match a user's baseline session.

Detection Strategies

Inspect web server and reverse proxy logs for GET /api/redirect requests whose code parameter fails a strict alphanumeric OAuth-code allowlist.
Deploy a Web Application Firewall (WAF) rule that blocks or alerts on script-context breakout patterns in query strings targeting /api/redirect.
Correlate session token usage with source IP and user agent changes to surface post-XSS session hijacking.

Monitoring Recommendations

Enable Content Security Policy (CSP) violation reporting to capture inline script execution attempts stemming from injected payloads.
Forward Activepieces application and access logs to a central SIEM and alert on anomalous /api/redirect traffic volume.
Monitor Activepieces API audit trails for workflow creation, credential access, or piece installation events tied to unexpected sessions.

How to Mitigate CVE-2026-73084

Immediate Actions Required

Upgrade all Activepieces instances to version 0.83.0 or later without delay.
Invalidate active user sessions and rotate any OAuth client secrets or API tokens that may have been exposed.
Review Activepieces audit logs for suspicious workflow modifications or connection changes since the endpoint became reachable.

Patch Information

The fix is available in Activepieces 0.83.0 and tracked in GHSA-hc39-cm5m-q8g7. The remediation, applied in commit 8be4c8d, routes redirect-endpoint rendering through the Mustache templating engine so that user-supplied values are escaped before insertion into the response.

Workarounds

Block or filter requests to /api/redirect at a reverse proxy or WAF until the upgrade can be applied.
Restrict access to the Activepieces UI to authenticated networks or VPN users to reduce the attack surface for phishing-delivered links.
Enforce a strict Content Security Policy that disallows inline scripts and unsafe eval to blunt payload execution.

bash

# Example NGINX rule to block suspicious /api/redirect requests
location = /api/redirect {
    if ($arg_code ~* "[<>\"']|script|%3C|%3E") {
        return 400;
    }
    proxy_pass http://activepieces_backend;
}