CVE-2026-18266

Received Received - Intake

Dify AI Workflow Open Redirect Vulnerability

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Zero Day Initiative

Description

Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Dify. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the OAuth flow handling in the AppInitializer component. An attacker can force a redirection to a site that serves malicious content. An attacker can leverage this vulnerability to disclose information in the context of the application. Was ZDI-CAN-29196.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-18266

Affected Vendors & Products

Vendor	Product	Version / Range
dify	dify	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This is an open redirect vulnerability in Dify AI Workflow where the oauth_redirect_url parameter can be manipulated to redirect users to malicious sites. It exists in the OAuth flow handling of the AppInitializer component and requires user interaction to exploit.

Detection Guidance

Detecting this vulnerability requires monitoring for unexpected OAuth redirections in Dify's AppInitializer component. Check web server logs for unusual redirect patterns or user reports of suspicious redirects. No specific commands are provided in the context.

Impact Analysis

An attacker could trick you into visiting a malicious page or opening a malicious file, potentially leading to disclosure of sensitive information within the application context. User interaction is required for exploitation.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized disclosure of sensitive information. The open redirect flaw may allow attackers to access or expose user data, which could violate GDPR's data protection requirements or HIPAA's safeguards for protected health information.

Mitigation Strategies

Update Dify to the latest version to patch the OAuth redirect flaw. Restrict user access to untrusted domains during OAuth flows. Monitor for suspicious redirects and educate users about phishing risks.

Hi! I’m here to help you understand CVE-2026-18266. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70