Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can break out of the script context and execute arbitrary JavaScript in the Activepieces origin when a logged-in user opens it. An unauthenticated attacker can access the victim's session tokens or make authenticated API calls on the victim's behalf. This issue is fixed in version 0.83.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-73084 Cross-Site Scripting in Activepieces OAuth Callback Endpoint Prior to 0.83.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-73084
Post summary
The entry announces a new XSS vulnerability in Activepieces OAuth callbacks affecting versions before 0.83.0, implying that updating to 0.83.0 removes the flaw.
🚨*CVE* CVE-2026-73084 Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query paramet… https://www.cve.org/CVERecord?id=CVE-2026-73084 ----- Traducción: CVE-2026-73084 Act… http://infoflow.cloud`
Post summary
The post provides basic disclosure details of CVE-2026-73084, highlighting an input‑exposure flaw in Activepieces’ OAuth callback endpoint but does not mention any PoC, exploit, or mitigation.
CVE-2026-73084 Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query paramet… https://www.cve.org/CVERecord?id=CVE-2026-73084
Post summary
The CVE affects Activepieces’ OAuth redirect endpoint before version 0.83.0; upgrading to 0.83.0 or later removes the vulnerability.