{"id":"CVE-2026-111988","kind":"vulnerability","aliases":["CVE-2026-111988"],"related":[],"title":"Dyad: OAuth callback handler flaw allows cross-site request forgery","description":"A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1 can resolve this issue. The patch is named 39fbae87b38573616a1a3b152cdb292787bb1109. It is advisable to upgrade the affected component.","summary":"Dyad, an open-source app, has a cross-site request forgery flaw in its OAuth callback handler, up to version 1.16.0. A remote attacker can trick a logged-in user's browser into triggering actions in the app.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dyad","oauth","other"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Dyad version and compare it with `1.16.0`\n- unknown for other checks; the sources do not say which settings or endpoints expose the handler","fix":"- Upgrade Dyad to `1.17.0-beta.1` or later (patch commit `39fbae87b38573616a1a3b152cdb292787bb1109`)","status":"open","published_at":"2026-10-18T15:16:52+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T04:26:44+00:00","updated_at":"2026-10-25T04:26:44+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T04:26:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Dyad to `1.17.0-beta.1` or later (patch commit `39fbae87b38573616a1a3b152cdb292787bb1109`)","reach":"internet","title":"Dyad: OAuth callback handler flaw allows cross-site request forgery","impact":"medium","summary":"Dyad, an open-source app, has a cross-site request forgery flaw in its OAuth callback handler, up to version 1.16.0. A remote attacker can trick a logged-in user's browser into triggering actions in the app.","category":"other","nicknames":[],"who_cares":["dyad","oauth"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker triggers unwanted actions through a victim's browser session","analyst_note":"Confirm the affected OAuth flow and which actions the forged request can perform, using the NVD entry and the patch commit 39fbae87b38573616a1a3b152cdb292787bb1109.","how_to_check":"- Check the installed Dyad version and compare it with `1.16.0`\n- unknown for other checks; the sources do not say which settings or endpoints expose the handler","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running Dyad up to version 1.16.0 are affected, since the flaw is in its OAuth callback handler. The sources do not say which deployment modes or configurations expose it, so unknown whether a default install is reachable.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000607,"input_tokens":3370,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111988':14A,17A '-2026':13A,16A '1.16.0':42B,74C '1.17.0':108C '39fbae87b38573616a1a3b152cdb292787bb1109':118C 'action':57B 'advis':121C 'affect':75C,125C 'allow':6A 'app':25B,60B 'attack':45B,100C 'beta.1':109C 'browser':54B 'callback':3A,37B,87C 'compon':85C,126C 'cross':8A,29B,95C 'cross-sit':7A,28B,94C 'cve':12A,15A 'discov':66C 'dyad':1A,18B,20B,69C,71C 'dyad-sh':68C 'flaw':5A,33B,63C 'forgeri':11A,32B,98C 'function':82C 'handler':4A,38B,88C 'initi':103C 'issu':78C,113C 'log':50B 'logged-in':49B 'manipul':91C 'may':101C 'name':117C 'oauth':2A,19B,36B,86C 'open':23B 'open-sourc':22B 'patch':115C 'perform':89C 'remot':44B,104C 'request':10A,31B,97C 'resolv':111C 'result':92C 'secur':62C 'sh':70C 'site':9A,30B,96C 'sourc':24B 'trick':47B 'trigger':56B 'unknown':81C 'upgrad':105C,123C 'user':52B 'version':41B,107C","nicknames":[],"mitigations":[],"who_affected":"Teams running Dyad up to version 1.16.0 are affected, since the flaw is in its OAuth callback handler. The sources do not say which deployment modes or configurations expose it, so unknown whether a default install is reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T15:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111988","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111988","severity":null,"published_at":"2026-10-18T15:16:52+00:00","modified_at":"2026-10-19T17:17:06+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}