{"id":"CVE-2026-111988","title":"dyad-sh dyad OAuth Callback cross-site request forgery","summary":"A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack m…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C","cvssSource":"cna","cwe":["CWE-352","CWE-862"],"vendor":"dyad-sh","product":"dyad","affected":["dyad 1.0","dyad 1.1","dyad 1.2","dyad 1.3","dyad 1.4","dyad 1.5","dyad 1.6","dyad 1.7","dyad 1.8","dyad 1.9","dyad 1.10","dyad 1.11","dyad 1.12","dyad 1.13","dyad 1.14","dyad 1.15","dyad 1.16.0"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-19T15:42:34.822797Z"},"published":"2026-10-18","updated":"2026-10-19","sourceUpdated":"2026-10-19T16:37:41.939Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111988","references":[{"url":"https://vuldb.com/vuln/421654","label":"VDB-421654 | dyad-sh dyad OAuth Callback cross-site request forgery"},{"url":"https://vuldb.com/vuln/421654/cti","label":"VDB-421654 | CTI Indicators (IOB, IOC)"},{"url":"https://vuldb.com/cve/CVE-2026-111988","label":"CVE-2026-111988 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1007180","label":"Submit #1007180 | dyad-sh Dyad 1.12.0 CWE-352: Cross-Site Request Forgery (CSRF)"},{"url":"https://github.com/dyad-sh/dyad/security/advisories/GHSA-pqj5-w36j-2839"},{"url":"https://github.com/dyad-sh/dyad/pull/4433"},{"url":"https://github.com/dyad-sh/dyad/commit/39fbae87b38573616a1a3b152cdb292787bb1109"},{"url":"https://github.com/dyad-sh/dyad/releases/tag/v1.17.0-beta.1"},{"url":"https://github.com/dyad-sh/dyad/"}],"tags":["cve.org"],"epss":0.00196,"epssPercentile":0.08779,"ingestedAt":"2026-10-18T14:44:23.536Z","slug":"CVE-2026-111988","body":"## Overview\n\nA security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1 can resolve this issue. The patch is named 39fbae87b38573616a1a3b152cdb292787bb1109. It is advisable to upgrade the affected component.\n\n## Affected\n\n- `dyad 1.0`\n- `dyad 1.1`\n- `dyad 1.2`\n- `dyad 1.3`\n- `dyad 1.4`\n- `dyad 1.5`\n- `dyad 1.6`\n- `dyad 1.7`\n- `dyad 1.8`\n- `dyad 1.9`\n- `dyad 1.10`\n- `dyad 1.11`\n- `dyad 1.12`\n- `dyad 1.13`\n- `dyad 1.14`\n- `dyad 1.15`\n- `dyad 1.16.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}