Dify CVE-2026-18266

The target user must click a crafted OAuth link and complete the Dify authentication flow - passive exploitation without user interaction is not possible given UI:R in the CVSS vector. The vulnerability is triggered specifically within the OAuth flow handled by the AppInitializer component, meaning OAuth login must be enabled and in use on the Dify deployment. No attacker authentication is required (PR:N). Exploitation is limited by: (1) mandatory user interaction - the victim must actively follow the malicious link and authenticate; (2) OAuth must be configured and accessible on the target instance; (3) impact is bounded to information disclosure (token/credential leakage) rather than direct code execution or system compromise.

The CVSS 3.0 score of 5.4 (Medium) reflects a realistic assessment: network-accessible (AV:N), low complexity (AC:L), no attacker authentication required (PR:N), but mandatory user interaction (UI:R), with limited confidentiality and integrity impact (C:L/I:L) and no availability impact (A:N). No EPSS data was provided, and no KEV listing exists, so automated widespread exploitation is not confirmed. The primary real-world risk is targeted phishing: an attacker embeds the crafted OAuth URL in a spear-phishing email, the user authenticates against the legitimate Dify instance, and is then redirected to a malicious site. This threat model is particularly relevant for Dify deployments with third-party OAuth providers (e.g., Google, GitHub) where token leakage could grant broader access. The CPE wildcard ('*' for all versions) suggests no safe version exists yet, but the absence of a KEV entry and the UI:R requirement meaningfully constrain opportunistic mass exploitation.

An attacker crafts a Dify OAuth authorization URL substituting the redirect_url parameter with a domain they control (e.g., https://attacker.com/capture). The attacker delivers this URL via phishing email or malicious web page to a Dify user. The user clicks the link, authenticates normally against the Dify instance, and is transparently redirected to the attacker's server - which logs the OAuth authorization code or access token appended to the redirect URL, enabling the attacker to impersonate the victim within the application.