p PatchFirst

CVE-2026-111988

CVE-2026-111988 · dyad-sh dyad OAuth Callback cross-site request forgery

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1 can resolve this issue. The patch is named 39fbae87b38573616a1a3b152cdb292787bb1109. It is advisable to upgrade the affected component.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published
Updated

Affected products and versions

  • dyad

    Versions
    • 1.0: Affected
    • 1.1: Affected
    • 1.2: Affected
    • 1.3: Affected
    • 1.4: Affected
    • 1.5: Affected
    • 1.6: Affected
    • 1.7: Affected
    • 1.8: Affected
    • 1.9: Affected
    • 1.10: Affected
    • 1.11: Affected
    • 1.12: Affected
    • 1.13: Affected
    • 1.14: Affected
    • 1.15: Affected
    • 1.16.0: Affected
    • 1.17.0-beta.1: Not affected

    Update to 1.17.0-beta.1

Original sources

Check your server →