All vulnerabilities
CVE-2026-111988GHSA-pqj5-w36j-2839

dyad-sh dyad OAuth Callback cross-site request forgery

dyad-sh dyad
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1 can resolve this issue. The patch is named 39fbae87b38573616a1a3b152cdb292787bb1109. It is advisable to upgrade the affected component.

Text from CVE List

Affected versions 18

  • dyadaffected: 1.0CVE List
  • dyadaffected: 1.1CVE List
  • dyadaffected: 1.2CVE List
  • dyadaffected: 1.3CVE List
  • dyadaffected: 1.4CVE List
  • dyadaffected: 1.5CVE List
  • dyadaffected: 1.6CVE List
  • dyadaffected: 1.7CVE List
  • dyadaffected: 1.8CVE List
  • dyadaffected: 1.9CVE List
  • dyadaffected: 1.10CVE List
  • dyadaffected: 1.11CVE List
  • dyadaffected: 1.12CVE List
  • dyadaffected: 1.13CVE List
  • dyadaffected: 1.14CVE List
  • dyadaffected: 1.15CVE List
  • dyadaffected: 1.16.0CVE List
  • dyadunaffected: 1.17.0-beta.1CVE List

References 9