CVE-2026-73084 - Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint

Back Back to CVE browser

MEDIUM

Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint

Published Aug 11, 2026

6.1

MEDIUM

CVSS 3.1

EPSS 0.36%

Description

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can break out of the script context and execute arbitrary JavaScript in the Activepieces origin when a logged-in user opens it. An unauthenticated attacker can access the victim's session tokens or make authenticated API calls on the victim's behalf. This issue is fixed in version 0.83.0.

Affected products

Vendor Activepieces Product Activepieces Default
n/a
- Version
  < 0.83.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Activepieces

n/a

Version	Status	Constraints
< 0.83.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-94

Code Injection

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56552
Advisory
https://github.com/activepieces/activepieces/commit/8be4c8d5e6a79ccbaa74815027432a3c8c311385
x_refsource_MISC
https://github.com/activepieces/activepieces/releases/tag/0.83.0
x_refsource_MISC
https://github.com/activepieces/activepieces/security/advisories/GHSA-hc39-cm5m-q8g7
x_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56552		Advisory
https://github.com/activepieces/activepieces/commit/8be4c8d5e6a79ccbaa74815027432a3c8c311385		x_refsource_MISC
https://github.com/activepieces/activepieces/releases/tag/0.83.0		x_refsource_MISC
https://github.com/activepieces/activepieces/security/advisories/GHSA-hc39-cm5m-q8g7		x_refsource_CONFIRM