Cross-site request forgery in dyad OAuth Callback Handler
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Tampering, Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352 and CWE-862.
Summary
The dyad-sh dyad product from 1.0 before 1.17.0-beta.1 is affected. The OAuth Callback Handler does not adequately protect against forged cross-site requests (CWE-352), so a request made from another site can trigger actions the user did not intend. An unauthenticated remote attacker can exploit this with user interaction, and the impact is limited to integrity.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1 can resolve this issue. The patch is named 39fbae87b38573616a1a3b152cdb292787bb1109. It is advisable to upgrade the affected component.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| dyad-sh | dyad | 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8; 1.9; 1.10; 1.11; 1.12; 1.13; 1.14; 1.15; 1.16.0 | 1.17.0-beta.1 | Patch available | CNA |
- dyad Vendordyad-sh Affected 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8; 1.9; 1.10; 1.11; 1.12; 1.13; 1.14; 1.15; 1.16.0 Fixed in 1.17.0-beta.1 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dyad-sh:dyad:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:dyad-sh:dyad:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
Upgrade dyad to version 1.17.0-beta.1. The fix is the patch named 39fbae87b38573616a1a3b152cdb292787bb1109.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA dyad (dyad-sh) Fixed in 1.17.0-beta.1
Timeline
- 2026-10-18 Threatist record created from CVE-2026-111988
- 2026-10-18 Alias added: GHSA-4fm9-r4fh-q3w4
- 2026-10-19 CISA SSVC decision points changed
References
More dyad-sh vulnerabilities
- TI-2025-36424 Dyad Vulnerable to Remote Code Execution via Top-level Navigation in Preview Window CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-111988 · CVE Program
- CVE-2026-111988 · NVD
- FIRST EPSS
- GHSA-4fm9-r4fh-q3w4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences