CVE-2026-28288: 
Dify vulnerability analysis and mitigation

CVE-2026-28288 is a user enumeration vulnerability in Dify, an open-source LLM application development platform. The flaw allows unauthenticated attackers to determine whether a given email address is registered with a Dify instance by observing differing API responses. All versions prior to 1.9.0 (up to and including 1.8.1) are affected. It was disclosed on February 27, 2026, with a fix released in version 1.9.0. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is classified as CWE-204 (Observable Response Discrepancy): the Dify login API endpoint (POST /console/api/login) returns distinct HTTP status codes and error messages depending on whether the submitted email exists in the system. A valid email with a wrong password returns HTTP 401 with "Invalid email or password," while a non-existent email returns HTTP 400 with "Account not found" — a clear behavioral difference exploitable for enumeration. No authentication, special privileges, or user interaction is required; only network access to the Dify instance is needed. The fix, tracked in issue #24323, standardizes authentication error messages across login, registration, and password reset endpoints to return generic responses regardless of account existence (GitHub Advisory, GitHub Issue).

Successful exploitation allows an attacker to systematically identify valid email addresses registered on a Dify instance without any credentials. This information disclosure can facilitate targeted phishing campaigns, credential stuffing attacks, and social engineering against identified account holders. The impact is limited to confidentiality (low) with no direct integrity or availability consequences; however, the harvested email list can serve as a stepping stone for more severe follow-on attacks (GitHub Advisory).

A proof-of-concept is publicly available in the GitHub Security Advisory, demonstrating the differential API responses with simple HTTP requests. The EPSS score is approximately 0.042%, reflecting low but non-zero exploitation probability. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Nuclei detection templates for this CVE have been added to the ProjectDiscovery nuclei-templates repository, lowering the barrier for automated scanning (GitHub Advisory, Nuclei Templates).

1. Reconnaissance: Identify internet-facing Dify instances (versions ≤ 1.8.1) using tools like Shodan, Censys, or Nuclei with the available detection template targeting the /console/api/login endpoint.
2. Prepare email list: Compile a list of candidate email addresses to test (e.g., from LinkedIn, company directories, or common patterns).
3. Send login request with candidate email: Submit a POST request to /console/api/login with the candidate email and an arbitrary password:

POST /console/api/login HTTP/2
Host: <target>
Content-Type: application/json

{"email":"candidate@example.com","password":"","language":"en-US","remember_me":true}

4. Analyze response: If the response is HTTP 400 with "Account not found", the email is not registered. If the response is HTTP 401 with "Invalid email or password", the email exists in the system.
5. Iterate: Repeat steps 3–4 across the email list, respecting any rate limits or brute-force protections, to build a confirmed list of registered email addresses.
6. Leverage results: Use the enumerated email list for targeted phishing, credential stuffing, or further attacks against identified accounts (GitHub Advisory).

• Network: High volume of POST requests to /console/api/login from a single IP or small IP range, especially with varying email addresses and empty or identical passwords.
• Logs: Repeated HTTP 400 (Account not found) and HTTP 401 (Invalid email or password) responses in web/API access logs from the same source IP, indicating systematic enumeration attempts.
• Logs: Unusual patterns of failed login attempts across many distinct email addresses in a short time window, inconsistent with normal user behavior.
• Network: Automated scanning traffic matching Nuclei template signatures targeting the Dify login endpoint (GitHub Advisory).

Upgrade Dify to version 1.9.0 or later, which standardizes authentication error messages to prevent response discrepancy-based enumeration (GitHub Advisory). As interim mitigations, implement rate limiting and account lockout policies on the /console/api/login endpoint to reduce the feasibility of large-scale enumeration. Additionally, deploy a web application firewall (WAF) rule to detect and block high-frequency login attempts from single sources. Monitor API access logs for enumeration patterns as described in the IOCs section.

The vulnerability was reported by security researcher kast3t and disclosed by laipz8200 via GitHub's security advisory process. The Dify maintainers acknowledged the issue and addressed it in version 1.9.0 by standardizing authentication error messages across login, registration, and password reset flows (GitHub Issue). A technical write-up was published by Infinit Security shortly after disclosure (Infinit Security). The vulnerability received routine coverage from vulnerability aggregators and was assigned a low severity rating by the Dify team, consistent with the presence of existing brute-force protections as a mitigating factor.