What happened
NVD published CVE-2026-18266 (CVSS 5.4, Medium) on 2026-07-29, describing an open-redirect vulnerability in Dify's OAuth flow disclosed via Zero Day Initiative.
Why it matters
Dify is a popular open-source LLM app-development platform; while low severity, an open redirect in its OAuth flow could be used in phishing campaigns targeting Dify admins/developers to steal credentials or session tokens.
Attack vector
An attacker crafts a malicious oauth_redirect_url link; when a victim clicks it, they are redirected to an attacker-controlled site, potentially disclosing sensitive OAuth-flow information.
Affected systems
Dify AI Workflow (LangGenius) — oauth_redirect_url parameter
Mitigation
Apply the Dify patch referenced in ZDI-26-452; validate redirect URLs against an allowlist.