Dyad
Monthly
Cross-site request forgery in Dyad's OAuth Callback Handler affects Dyad through version 1.16.0 and can let a crafted dyad:// callback be accepted without proof that it belongs to a legitimate in-app connection flow, causing an integrity-only credential/integration state change. Exploitation is remote but requires the Dyad desktop app to be installed with its custom-protocol handler registered and requires the victim to launch or approve the crafted protocol link; there is no confidentiality or availability impact per the independent assessment, and the CVSS 4.0 base score is 5.3. Vendor-released patch: 1.17.0-beta.1; no public exploit identified at time of analysis.
Cross-site request forgery in Dyad's OAuth Callback Handler affects Dyad through version 1.16.0 and can let a crafted dyad:// callback be accepted without proof that it belongs to a legitimate in-app connection flow, causing an integrity-only credential/integration state change. Exploitation is remote but requires the Dyad desktop app to be installed with its custom-protocol handler registered and requires the victim to launch or approve the crafted protocol link; there is no confidentiality or availability impact per the independent assessment, and the CVSS 4.0 base score is 5.3. Vendor-released patch: 1.17.0-beta.1; no public exploit identified at time of analysis.