Description
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1 can resolve this issue. The patch is named 39fbae87b38573616a1a3b152cdb292787bb1109. It is advisable to upgrade the affected component.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dyad-sh | dyad | 1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12, 1.13, 1.14, 1.15, 1.16.0 | 1.17.0-beta.1 |
References
- VDB-421654 | dyad-sh dyad OAuth Callback cross-site request forgery vdb-entry
- VDB-421654 | CTI Indicators (IOB, IOC) signature permissions-required
- CVE-2026-111988 | CVE Analysis and Report third-party-advisory
- Submit #1007180 | dyad-sh Dyad 1.12.0 CWE-352: Cross-Site Request Forgery (CSRF) third-party-advisory
- https://github.com/dyad-sh/dyad/security/advisories/GHSA-pqj5-w36j-2839 related
- https://github.com/dyad-sh/dyad/pull/4433 issue-tracking patch
- https://github.com/dyad-sh/dyad/commit/39fbae87b38573616a1a3b152cdb292787bb1109 patch
- https://github.com/dyad-sh/dyad/releases/tag/v1.17.0-beta.1 patch
- https://github.com/dyad-sh/dyad/ product