CVE-2026-18266: 
Dify vulnerability analysis and mitigation

CVE-2026-18266 is an open redirect vulnerability in Dify AI Workflow's oauth_redirect_url parameter, affecting the AppInitializer component's OAuth flow handling. Discovered by David Fiser and Alfredo Oliveira of TrendAI Research and reported to the vendor on March 25, 2026, it was publicly disclosed on July 23, 2026 via ZDI advisory ZDI-26-452. The vulnerability affects Dify version 1.11.4 (developed by LangGenius) and carries a CVSS v3.0 base score of 5.4 (Medium) (ZDI Advisory, GitHub Advisory).

The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site / 'Open Redirect'). The flaw resides in the OAuth flow handling within Dify's AppInitializer component, where the oauth_redirect_url parameter is accepted without sufficient validation, allowing an attacker to supply an arbitrary external URL as the post-authentication redirect destination. No privileges are required to craft the malicious redirect, but user interaction is necessary — the victim must visit a malicious page or open a malicious file that triggers the OAuth flow with the attacker-controlled redirect URL. A vendor-issued fix is referenced in GitHub pull request #38864 (ZDI Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to redirect authenticated users to attacker-controlled sites, enabling disclosure of sensitive information (e.g., OAuth tokens, session credentials, or other application context data) passed in the redirect flow. The integrity impact is low, as the attacker can influence where users are sent post-login, potentially facilitating phishing or credential harvesting. Availability is not impacted, and the scope remains unchanged, limiting the blast radius to the application context (ZDI Advisory, GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.243% (16th percentile), indicating a low near-term exploitation probability. The NVD SSVC assessment classifies exploitation as 'none' and the attack as non-automatable due to the required user interaction. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, ZDI Advisory).

1. Reconnaissance: Identify publicly accessible Dify instances running version 1.11.4 or earlier, particularly those with OAuth-based login enabled.
2. Craft malicious redirect URL: Construct a URL targeting Dify's OAuth initiation endpoint with the oauth_redirect_url parameter set to an attacker-controlled domain (e.g., https://dify-instance/oauth/login?oauth_redirect_url=https://attacker.com/capture).
3. Deliver to victim: Embed the crafted URL in a phishing email, malicious webpage, or document that the target user is likely to click, initiating the OAuth flow.
4. Victim authenticates: The victim visits the link and completes the OAuth login process on the legitimate Dify instance.
5. Capture sensitive data: Upon successful authentication, Dify's AppInitializer redirects the user to the attacker-controlled site, potentially transmitting OAuth tokens, session identifiers, or other sensitive parameters appended to the redirect URL, which the attacker captures (ZDI Advisory).

• Network: Outbound HTTP redirects (3xx responses) from the Dify application server to external, non-allowlisted domains following OAuth login completions; unusual referrer headers pointing to external sites in post-login traffic.
• Logs: Application or web server logs showing OAuth callback requests with oauth_redirect_url values pointing to external or unexpected domains; repeated OAuth flow initiations from the same source IP with varying redirect URLs.
• Application Behavior: Users reporting unexpected redirects to unfamiliar sites after logging into Dify via OAuth; reports of credential or session token reuse from unexpected geographic locations shortly after login.

The vendor (LangGenius) has issued a fix referenced in GitHub pull request #38864, which addresses the open redirect in the OAuth flow. Users should update Dify to a version that includes this patch as soon as it is available. As a workaround, administrators should implement strict server-side allowlisting of permitted OAuth redirect URIs, rejecting any oauth_redirect_url values not matching pre-registered, trusted URIs. Additionally, consider displaying a redirect confirmation warning to users before executing post-login redirects (ZDI Advisory, GitHub Advisory).

The vulnerability was discovered and responsibly disclosed by David Fiser and Alfredo Oliveira of TrendAI Research, who published a blog post detailing how their research led to the closure of the open redirect in Dify's post-login flow. The ZDI coordinated the disclosure over approximately four months before public release. No significant broader community or social media discussion has been observed beyond standard vulnerability database aggregation (TrendAI Blog, ZDI Advisory).