Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-73084Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint

Medium 6.1

In plain English

A medium-severity cross-site scripting in activepieces from activepieces. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.4%top 70.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can break out of the script context and execute arbitrary JavaScript in the Activepieces origin when a logged-in user opens it. An unauthenticated attacker can access the victim's session tokens or make authenticated API calls on the victim's behalf. This issue is fixed in version 0.83.0.

Affected products (as reported)

Vendor	Product	Versions
activepieces	activepieces	< 0.83.0

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/activepieces/activepieces/security/advisories/GHSA-hc39-cm5m-q8g7 x_refsource_CONFIRM
https://github.com/activepieces/activepieces/commit/8be4c8d5e6a79ccbaa74815027432a3c8c311385 x_refsource_MISC
https://github.com/activepieces/activepieces/releases/tag/0.83.0 x_refsource_MISC