Executive brief
Dify, an open-source platform for building AI applications, is affected by a security flaw in how it handles user logins via third-party services (OAuth). An attacker could trick a user into clicking a malicious link that redirects them from the legitimate Dify site to a fraudulent website. This could be used to steal sensitive information or conduct phishing attacks against Dify users.
Technical details
An open redirect vulnerability (CWE-601) exists in the AppInitializer component of Dify during the OAuth flow handling. The application fails to properly validate the 'oauth_redirect_url' parameter, allowing an attacker to specify an arbitrary external URL. To exploit this, an attacker must entice a user to visit a specially crafted link. Successful exploitation allows the attacker to redirect the user's browser to a malicious site, potentially leading to the disclosure of sensitive information in the context of the application. A fix has been identified in the project's GitHub repository via pull request 38864.
Affected products
- LangGenius Dify 1.11.4
Timeline
- 2026-03-25: disclosed: Vulnerability reported to vendor
- 2026-07-23: advisory: Coordinated public release of advisory ZDI-26-452
- 2026-07-29: patched: Advisory updated with patch information