CVE-2026-111988 Details
Description
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1 can resolve this issue. The patch is named 39fbae87b38573616a1a3b152cdb292787bb1109. It is advisable to upgrade the affected component.
A cross-site request forgery vulnerability has been identified in the OAuth Callback Handler of dyad-sh versions through 1.16.0. This issue allows remote attackers to manipulate OAuth deep-link callbacks, injecting credentials for Neon or Supabase accounts under their control. The vulnerability arises because the application accepted callback links without verifying that they corresponded to an active connection flow initiated by the user. As a result, an attacker could replace a user's existing OAuth credentials with those from an account they control, without any in-app notification or consent.
Users should upgrade to dyad-sh version 1.17.0-beta.1, which addresses this vulnerability by implementing a verification process for OAuth callbacks. After upgrading, it is recommended to disconnect and reconnect Neon and Supabase in Dyad's settings to ensure that the correct credentials are being used.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dyad-sh/dyad/ | [email protected] | ProductVendor |
| https://github.com/dyad-sh/dyad/commit/39fbae87b38573616a1a3b152cdb292787bb1109 | [email protected] | Source CodeVendor |
| https://github.com/dyad-sh/dyad/pull/4433 | [email protected] | Issue TrackingVendor |
| https://github.com/dyad-sh/dyad/releases/tag/v1.17.0-beta.1 | [email protected] | Release NotesVendor |
| https://github.com/dyad-sh/dyad/security/advisories/GHSA-pqj5-w36j-2839 | [email protected] | AdvisoryExploitRemedyVendor |
| https://vuldb.com/cve/CVE-2026-111988 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1007180 | [email protected] | Permission Required |
| https://vuldb.com/vuln/421654 | [email protected] | Permission Required |
| https://vuldb.com/vuln/421654/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dyad-sh dyad | <= 1.16.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |