Medium severity · published Aug 11, 2026
CVE-2026-73084
Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can break out of the script context and execute arbitrary JavaScript in the Activepieces origin when a logged-in user opens it. An unauthenticated attacker can access the victim's session tokens or make authenticated API calls on the victim's behalf. This issue is fixed in version 0.83.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
activepieces · activepieces
< 0.83.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73084
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73084
github.com
https://github.com/activepieces/activepieces/commit/8be4c8d5e6a79ccbaa74815027432a3c8c311385
github.com
https://github.com/activepieces/activepieces/releases/tag/0.83.0
github.com
https://github.com/activepieces/activepieces/security/advisories/GHSA-hc39-cm5m-q8g7
More from activepieces
9.3
CVE-2026-48499
Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache
8.7
CVE-2026-73081
Activepieces: Remote Code Execution via Command Injection in Code Step Name
7.6
CVE-2026-73083
Activepieces: V8 Isolate Sandbox Bypass via importFresh Module Loading
6.3
CVE-2026-12813
activepieces File URL file.ts handleUrlFile server-side request forgery
5.9
CVE-2026-53535
Activepieces: Arbitrary file write in git-sync via path traversal and symlinks