CVE-2026-47194

CVE-2026-47194 exposes a design flaw in Frappe/ERPNext's magic link authentication: the framework uses the HTTP Host header to construct magic link URLs in password reset and login emails. An attacker who can influence the Host header — through a direct request or via an intermediate proxy — can cause the magic link to point to an arbitrary domain. When the victim clicks the link, they send the token to the attacker's server, granting account takeover without any password compromise. This isn't a coding error — it's a pragmatic architectural choice that prioritized deployment flexibility over security boundaries. In multi-tenant Frappe deployments, using the Host header means one codebase handles multiple domains without manual configuration. But magic links invert the traditional authentication model: with passwords, the secret lives in the user's head and phishing requires credentials; with magic links, the token is the secret and the attacker only needs the victim to click. The delivery mechanism became the attack surface, and the Host header became user-controllable input in a security-critical path. Check your Frappe deployment immediately: review where password reset and magic link emails are generated, verify that the domain portion of the URL is drawn from a configured trusted base URL rather than the incoming request's Host header, and confirm your reverse proxy isn't passing through unvalidated Host headers. The fix requires pinning to an explicit domain configuration — not just validating that the Host matches a whitelist on each request, but hardcoding the trusted domain into the authentication flow. This pattern likely exists elsewhere. Magic links have proliferated as a UX improvement across frameworks, but security auditing focused on token entropy and expiry rather than the delivery mechanism. Treat any magic link implementation that trusts HTTP headers for link construction as a potential phishing infrastructure. Audit your own dependencies: if your framework of choice generates auth links from request values rather than configuration, you've got the same problem Frappe just fixed.

Reviewed through automated stages and approved by a human before publication.