Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, carefully crafted request could lead malicious actor getting access user's password reset token. This can only be exploited on self hosted instances configured in certain way. Frappe Cloud users are safe. issue has been patched 15.58.0. Workarounds for this involve verifying URLs before clicking them or upgrading users.