CVE-2026-18266 in Dify
Summary
by MITRE • 07/29/2026
Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Dify. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the OAuth flow handling in the AppInitializer component. An attacker can force a redirection to a site that serves malicious content. An attacker can leverage this vulnerability to disclose information in the context of the application. Was ZDI-CAN-29196.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability under discussion represents a critical open redirect flaw within the Dify AI Workflow platform's OAuth implementation, specifically affecting the AppInitializer component that manages authentication flows. This issue stems from inadequate validation of redirect URLs during the OAuth authorization process, creating an avenue for malicious actors to manipulate the redirection behavior and potentially compromise user sessions or extract sensitive data. The vulnerability was identified as ZDI-CAN-29196 and demonstrates a classic open redirect vulnerability pattern that has been documented across numerous web applications. The flaw operates by accepting unvalidated redirect parameters from OAuth providers without proper sanitization or verification against a whitelist of approved domains, allowing attackers to craft malicious URLs that would redirect users to attacker-controlled resources.
The technical execution of this vulnerability requires user interaction through a phishing attack vector where victims are lured to visit malicious websites or open compromised files containing crafted URLs. When users initiate the OAuth flow and are redirected back to the application, the flawed implementation fails to validate whether the redirect URL originates from an authorized domain, enabling attackers to specify arbitrary destinations for the final redirection step. This creates a dangerous situation where legitimate users might be unknowingly redirected to malicious sites that can harvest session cookies, credentials, or other sensitive information. The vulnerability operates at the application layer and specifically targets the authentication and authorization mechanisms that are fundamental to secure user access control within web applications.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable more severe attacks including session hijacking, credential theft, and man-in-the-middle scenarios. Attackers can leverage this weakness to create convincing phishing pages that appear legitimate due to the trusted redirect behavior, making social engineering attacks more effective and harder to detect. The vulnerability affects all users who interact with the Dify platform through OAuth authentication methods, particularly those who might be targeted in spear-phishing campaigns or who frequently access the application from potentially compromised devices. The risk is compounded by the fact that this vulnerability can be exploited without requiring any special privileges or advanced technical skills, making it accessible to a broad range of threat actors.
Security mitigations for this vulnerability should focus on implementing strict URL validation and domain whitelisting within the OAuth redirect handling logic. Organizations should ensure that all redirect URLs are validated against a predefined list of approved domains before any redirection occurs, preventing arbitrary redirects to malicious sites. The implementation should follow established security practices such as those outlined in CWE-601 Open Redirect and align with ATT&CK techniques targeting credential access through phishing and social engineering. Additional protective measures include implementing proper input validation, using secure OAuth libraries that handle redirects safely, and conducting regular security assessments of authentication flows to identify similar vulnerabilities. Organizations should also consider implementing additional monitoring for unusual redirect patterns and user behavior that might indicate exploitation attempts.
This vulnerability highlights the critical importance of validating all user-supplied inputs in authentication flows and demonstrates how seemingly minor implementation flaws can create significant security risks. The attack surface is particularly concerning given that OAuth flows are widely used across modern web applications, making this type of vulnerability potentially exploitable across multiple platforms. Security teams should prioritize patching this vulnerability as a high-priority item and conduct comprehensive reviews of all authentication-related code to identify similar issues. The incident serves as a reminder that even well-established security protocols like OAuth require careful implementation and validation to prevent exploitation by attackers seeking to leverage legitimate authentication flows for malicious purposes. Organizations should also consider implementing additional security controls such as multi-factor authentication and session management policies to reduce the potential impact of successful exploitation attempts.