Description
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1 can resolve this issue. The patch is named 39fbae87b38573616a1a3b152cdb292787bb1109. It is advisable to upgrade the affected component.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
dyad-sh dyad
1.0affected1.1affected1.2affected1.3affected1.4affected1.5affected1.6affected1.7affected1.8affected1.9affected1.10affected1.11affected1.12affected1.13affected1.14affected1.15affected1.16.0affected1.17.0-beta.1unaffected
References
- https://vuldb.com/vuln/421654 ↗
- https://vuldb.com/vuln/421654/cti ↗
- https://vuldb.com/cve/CVE-2026-111988 ↗
- https://vuldb.com/submit/1007180 ↗
- https://github.com/dyad-sh/dyad/security/advisories/GHSA-pqj5-w36j-2839 ↗
- https://github.com/dyad-sh/dyad/pull/4433 ↗
- https://github.com/dyad-sh/dyad/commit/39fbae87b38573616a1a3b152cdb292787bb1109 ↗
- https://github.com/dyad-sh/dyad/releases/tag/v1.17.0-beta.1 ↗
- https://github.com/dyad-sh/dyad/ ↗