CVE-2026-73084

The vulnerability in Activepieces stems from an authorization code parameter flowing from an OAuth callback into an inline script block without output encoding, creating a reflected XSS. What makes this worth your attention isn't the XSS mechanics—it's the structural trap that produced it. OAuth callback codes occupy a psychological blind spot. Developers sanitize URL parameters and form inputs reflexively, but the authorization code 'feels' different because a trusted authorization server issued it. That assumption is wrong, and it's reinforced by how most OAuth libraries and documentation present callback examples—embedding parameters directly into templates is the path of least resistance. The inline script context compounds this by removing the visual boundary cues that would normally signal a context switch. You're not dealing with negligent input handling; you're dealing with a mental model that the OAuth ecosystem teaches and reinforces. Version 0.83.0 addressed this, but the fix methodology matters enormously for your long-term posture. Output encoding at the view layer closes this specific sink but leaves the inline script pattern intact for whatever parameter flows through next. Removing the inline script entirely makes the context boundary visible in code structure. CSP headers are the only approach that addresses the structural problem—but only if they're enforced, not in report-only mode. If you're evaluating Activepieces or a similar workflow automation platform, recognize that the CVSS 6.1 score doesn't capture the credential topology risk. These platforms aggregate OAuth tokens across Gmail, Slack, GitHub, and other high-value services. A session compromise here isn't 'read one profile'—it's lateral movement into everything the victim connected. The blast radius exceeds what the severity score communicates, and your incident response prioritization should reflect that. Treat OAuth callback XSS in workflow platforms as higher urgency than the numeric severity suggests, because the window between exploit and pivoting to connected services collapses to minutes. Audit your own OAuth implementations for inline script patterns, particularly in callback handlers. If you find them, rank removal or CSP above output encoding as your remediation approach—the safe alternative needs to become the path of least resistance, or the next parameter through the same path will reproduce this vulnerability.

Reviewed through automated stages and approved by a human before publication.