CVE-2026-111988: dyad-sh dyad OAuth Callback cross-site request forgery
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1 can resolve this issue. The patch is named 39fbae87b38573616a1a3b152cdb292787bb1109. It is advisable to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dyad-sh dyadto a version that resolves this vulnerability.Fixed in 1.17.0-beta.1Patch 39fbae87b38573616a1a3b152cdb292787bb1109
Event History
Frequently Asked Questions
Which deployments are affected?
dyad-sh dyad versions up to and including 1.16.0 are affected in an unspecified part of the OAuth Callback Handler.
What does an attacker need to exploit this issue?
The attack can be initiated remotely and requires user interaction. No privileges are required according to the provided vector.
Is there a fix available?
Upgrade dyad-sh dyad to version 1.17.0-beta.1 or later if available. The identified patch is 39fbae87b38573616a1a3b152cdb292787bb1109.