CVE-2026-111988
Received Received - Intake

Cross-Site Request Forgery in dyad up to 1.16.0

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulDB

Description
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1 can resolve this issue. The patch is named 39fbae87b38573616a1a3b152cdb292787bb1109. It is advisable to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-111988
EUVD
EUVD-2026-103669

Affected Vendors & Products

Showing 17 associated CPEs
Vendor Product Version / Range
dyad-sh dyad 1.0
dyad-sh dyad 1.1
dyad-sh dyad 1.2
dyad-sh dyad 1.3
dyad-sh dyad 1.4
dyad-sh dyad 1.5
dyad-sh dyad 1.6
dyad-sh dyad 1.7
dyad-sh dyad 1.8
dyad-sh dyad 1.9
dyad-sh dyad 1.10
dyad-sh dyad 1.11
dyad-sh dyad 1.12
dyad-sh dyad 1.13
dyad-sh dyad 1.14
dyad-sh dyad 1.15
dyad-sh dyad 1.16.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the OAuth callback handler of dyad-sh dyad versions up to 1.16.0. It allows attackers to inject malicious OAuth tokens via crafted dyad:// links, which can overwrite a victim's Neon or Supabase account credentials without their knowledge. The attack requires user interaction (opening the link) but no authentication.

Impact Analysis

If exploited, this vulnerability could allow an attacker to replace your Neon or Supabase account credentials with their own. This may lead to data exposure if you create or connect databases afterward, as they would belong to the attacker's account. It compromises data integrity and availability, though the attacker cannot access your existing data directly.

Compliance Impact

This vulnerability could lead to unauthorized access or control over user data, violating GDPR's data integrity and confidentiality principles and HIPAA's safeguards for protected health information. Affected organizations may face compliance breaches if user data is exposed or manipulated due to this flaw.

Mitigation Strategies
  • Upgrade Dyad to version 1.17.0-beta.1 or later to address the OAuth callback vulnerability.
  • Reconnect Neon and Supabase accounts after upgrading to ensure credentials are properly validated.
  • Avoid opening dyad:// links from untrusted sources until the upgrade is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111988. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart