Submit #1007180: dyad-sh Dyad 1.12.0 CWE-352: Cross-Site Request Forgery (CSRF)

A cross-site request forgery (CSRF) vulnerability exists in Dyad
1.12.0 due to insufficient validation of OAuth callback deep links.

Dyad registers the dyad:// custom URI scheme and accepts
dyad://neon-oauth-return and dyad://supabase-oauth-return callbacks.
Before the fix, the callback did not contain a value that bound it to
an OAuth connection flow previously initiated by the application.

An unauthenticated remote attacker can obtain valid Neon or Supabase
OAuth credentials under an account controlled by the attacker and
construct a malicious dyad:// callback URL containing the attacker-
controlled token and refresh token. If a victim opens the crafted
link and accepts the operating system's request to open Dyad, the
application processes the callback and stores the supplied
credentials without verifying that the callback corresponds to a
connection flow initiated by the victim.

This can result in replacement of an existing Neon credential or
addition of an attacker-controlled Supabase organization. The
attacker does not obtain the victim's existing Neon or Supabase
credentials or existing data. However, applications subsequently
created or connected through the attacker-controlled credentials may
be associated with infrastructure controlled by the attacker.

The vulnerability affects the Neon and Supabase OAuth deep-link
callback handlers.

The issue was fixed in Dyad 1.17.0 by introducing a provider-bound,
single-use and time-limited OAuth flow identifier. The identifier is
generated when the connection flow starts, passed through the OAuth
proxy, and returned in the dyad:// callback. Dyad now persists
credentials only when the returned identifier exactly matches an
active connection flow.

• Quelle: ⚠️ https://github.com/dyad-sh/dyad/security/advisories/GHSA-pqj5-w36j-2839
• Benutzer: Aston (UID 99628)
• Einreichung: 30.09.2026 07:49 (vor 26 Tagen)
• Moderieren: 17.10.2026 23:54 (18 days later)
• Status: Akzeptiert
• VulDB Eintrag: 421654 [dyad-sh dyad bis 1.16.0 OAuth Callback Cross Site Request Forgery]
• Punkte: 20