무슨 일이 있었나
NVD는 2026-07-29에 CVE-2026-
왜 중요한가
Dify is a popular open-source LLM app-development platform; while low severity, an open redirect in its OAuth flow could be used in phishing campaigns targeting Dify admins/developers to steal credentials or session tokens.
공격 경로
An attacker crafts a malicious oauth_redirect_url link; when a victim clicks it, they are redirected to an attacker-controlled site, potentially disclosing sensitive OAuth-flow information.
영향받는 시스템
Dify AI Workflow (LangGenius) — oauth_redirect_url parameter
완화 방안
Apply the Dify patch referenced in ZDI-26-452; validate redirect URLs against an allowlist.