Press, a Frappe custom app used for managing infrastructure and SaaS, contains a reflected XSS vulnerability (CWE-79) in the redirect parameter on its login page. This improper input neutralization can lead to script injection when the redirect parameter is manipulated. The vulnerability is addressed by a patch that limits redirects to internal URLs only, preventing exploitation via external redirect targets. The CVSS 4.0 base score is 1.3, indicating low severity. No official remediation level or vendor advisory is provided, but the patch is identified by the commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application via the redirect parameter on the login page. This may lead to limited impacts such as session hijacking or phishing within the scope of the affected app. The low CVSS score reflects the limited impact and ease of exploitation requiring user interaction. No known exploits have been reported in the wild.

A patch is available in the commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 that fixes the vulnerability by restricting redirects to internal URLs only. Users and administrators should upgrade to a version including this commit to remediate the issue. Since no official vendor advisory or remediation level is provided, verify the patch application in your environment. Until patched, avoid using untrusted input in the redirect parameter.