Vulnerability · Published Oct 18, 2026 · Assigned by VulDB

CVE-2026-111988dyad-sh dyad OAuth Callback cross-site request forgery

Medium 4.3

In plain English

A medium-severity cross-site request forgery in dyad from dyad-sh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 90.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1 can resolve this issue. The patch is named 39fbae87b38573616a1a3b152cdb292787bb1109. It is advisable to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
dyad-sh	dyad	1.01.11.21.31.41.51.61.7

Weakness: CWE-352, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C

References

VDB-421654 | dyad-sh dyad OAuth Callback cross-site request forgery vdb-entry
VDB-421654 | CTI Indicators (IOB, IOC) signature, permissions-required
CVE-2026-111988 | CVE Analysis and Report third-party-advisory
Submit #1007180 | dyad-sh Dyad 1.12.0 CWE-352: Cross-Site Request Forgery (CSRF) third-party-advisory
https://github.com/dyad-sh/dyad/security/advisories/GHSA-pqj5-w36j-2839 related
https://github.com/dyad-sh/dyad/pull/4433 issue-tracking, patch
https://github.com/dyad-sh/dyad/commit/39fbae87b38573616a1a3b152cdb292787bb1109 patch
https://github.com/dyad-sh/dyad/releases/tag/v1.17.0-beta.1 patch
https://github.com/dyad-sh/dyad/ product