UpHeron
All vulnerabilities

Servers and applications

GHSA-h3mh-9vmc-cpfg

OAuth2 password grant bypasses two-factor authentication

Severity
High
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
15.121.1, 16.35.0
Weakness
Improper authentication (CWE-287)Insufficiently protected credentials (CWE-522)
Sources
Project advisories (GitHub)

Description

The OAuth2 token endpoint accepted an undocumented password grant (Resource Owner Password Credentials), letting anyone with valid user credentials obtain a full-access OAuth token while bypassing two-factor authentication and forced password reset.

From frappe/frappe's security advisory.

Workarounds

There are no workarounds. Updating to the latest versions of Frappe Framework should resolve this.

Workarounds as given by frappe/frappe's security advisory.

Affected software

SoftwareAffected versions
Frappe FrameworkServers and applications · github:frappe/frappe
  • Every version before 16.35.0
  • Every version before 15.121.1

References