Live › vulnerability › CVE-2026-111988
Go to dashboardDyad, an open-source app, has a cross-site request forgery flaw in its OAuth callback handler, up to version 1.16.0. A remote attacker can trick a logged-in user's browser into triggering actions in the app.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Dyad up to version 1.16.0 are affected, since the flaw is in its OAuth callback handler. The sources do not say which deployment modes or configurations expose it, so unknown whether a default install is reachable.
No product ranges from the sources yet.
1.16.01.17.0-beta.1 or later (patch commit 39fbae87b38573616a1a3b152cdb292787bb1109)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1 can resolve this issue. The patch is named 39fbae87b38573616a1a3b152cdb292787bb1109. It is advisable to upgrade the affected component.
This page as .md · .json · in your agent: get_signal("CVE-2026-111988")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.