{"id":"CVE-2026-111988","published":"2026-10-18T15:16:52.483","lastModified":"2026-10-18T15:16:52.483","description":"A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1 can resolve this issue. The patch is named 39fbae87b38573616a1a3b152cdb292787bb1109. It is advisable to upgrade the affected component.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwes":["CWE-352","CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/dyad-sh/dyad/","tags":[]},{"url":"https://github.com/dyad-sh/dyad/commit/39fbae87b38573616a1a3b152cdb292787bb1109","tags":[]},{"url":"https://github.com/dyad-sh/dyad/pull/4433","tags":[]},{"url":"https://github.com/dyad-sh/dyad/releases/tag/v1.17.0-beta.1","tags":[]},{"url":"https://github.com/dyad-sh/dyad/security/advisories/GHSA-pqj5-w36j-2839","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-111988","tags":[]},{"url":"https://vuldb.com/submit/1007180","tags":[]},{"url":"https://vuldb.com/vuln/421654","tags":[]},{"url":"https://vuldb.com/vuln/421654/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/dyad-sh/dyad/","tags":[]},{"url":"https://github.com/dyad-sh/dyad/commit/39fbae87b38573616a1a3b152cdb292787bb1109","tags":[]},{"url":"https://github.com/dyad-sh/dyad/pull/4433","tags":[]},{"url":"https://github.com/dyad-sh/dyad/releases/tag/v1.17.0-beta.1","tags":[]},{"url":"https://github.com/dyad-sh/dyad/security/advisories/GHSA-pqj5-w36j-2839","tags":[]}],"hasPoc":true,"ai":null}