CVE Explorer
CVE-2026-18266
Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Dify. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the OAuth flow handling in the AppInitializer component. An attacker can force a redirection to a site that serves malicious content. An attacker can leverage
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unknown","product":"Dify","vendor":"LangGenius","versions":[{"status":"affected","version":"1.11.4"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:9435cf1836b9f178d0efea1e5e149bdfed5d05d2445050fb082a3d2fae5a2684 · sha256:95be9ac7a41cf254… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.0"},"metric_type":"cvssV3_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:9435cf1836b9f178d0efea1e5e149bdfed5d05d2445050fb082a3d2fae5a2684 · sha256:95be9ac7a41cf254… · /containers/cna/metrics/0/cvssV3_0
CWE assertions
1 source assertion{"cweId":"CWE-601","description":"CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:9435cf1836b9f178d0efea1e5e149bdfed5d05d2445050fb082a3d2fae5a2684 · sha256:95be9ac7a41cf254… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"name":"ZDI-26-452","tags":["x_research-advisory"],"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-452/"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:9435cf1836b9f178d0efea1e5e149bdfed5d05d2445050fb082a3d2fae5a2684 · sha256:95be9ac7a41cf254… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.