CVE-2026-18266

Executive Summary

CVE-2026-18266 is an open redirect vulnerability in the Dify AI Workflow OAuth flow, specifically within the AppInitializer component's handling of the oauth_redirect_url parameter. A remote, unauthenticated attacker can craft a malicious link that, when clicked by an authenticated user, redirects the user to an attacker-controlled domain serving phishing or credential-harvesting content. The vulnerability carries a CVSS score of 5.4 (Medium), and while it requires user interaction, the low complexity and network attack vector make it a practical phishing enabler. No public exploit or patch exists at the time of writing; all Dify deployments are potentially affected.

Technical Analysis

The vulnerability resides in the OAuth flow handling logic of the AppInitializer component within Dify AI Workflow. Dify is a popular open-source LLM application development platform that supports OAuth-based authentication for workflow automation and integration with external services. The platform allows developers to configure OAuth redirect URLs to return users to specific application endpoints after authentication.

The specific flaw: When the AppInitializer processes an OAuth handshake, it reads the oauth_redirect_url parameter from the incoming request and uses it to construct a Location header for the HTTP redirect response. The application fails to validate that the URL host is an allowed origin or matches the application's own domain. This enables an attacker to supply an arbitrary URL:

https://victim-dify-instance.com/oauth/callback?oauth_redirect_url=https://evil.example.com/phish

The application will process the OAuth token exchange (which may complete successfully) and then issue an HTTP 302 redirect to https://evil.example.com/phish. Crucially, because the OAuth token exchange may complete before the redirect, the attacker's phishing page can receive session cookies, OAuth state parameters, or other sensitive context via URL parameters or referrer headers.

Attack surface:

• All Dify deployments exposing the OAuth callback endpoint (/oauth/callback or similar) to the internet.
• Phishing campaigns targeting Dify platform users with administrator or developer privileges.
• The open redirect can also be chained with token leakage if the application appends authorization codes or tokens to the redirect URL.

Exploitation Scenarios

The attack chain for exploiting CVE-2026-18266:

Step 1 — Reconnaissance: An attacker identifies a target Dify instance using Shodan dorks (e.g., http.title:"Dify") or by crawling GitHub for public Dify deployments. The attacker confirms the OAuth endpoint exists by issuing a request to https://target-dify.com/oauth/callback and observing the HTTP 302 response with a Location header.

Step 2 — Crafting the malicious URL: The attacker constructs a phishing URL that leverages the open redirect:

https://target-dify.com/oauth/callback?code=<attacker-supplied-or-legitimate-code>&oauth_redirect_url=https://evil.example.com/steal

The attacker registers a domain (evil.example.com) that serves a page mimicking the Dify login or workflow configuration interface. If the code parameter is not required for the redirect to be processed, the attacker may simply omit it and rely purely on the redirect mechanics.

Step 3 — Delivery: The attacker sends the crafted URL via spear-phishing email, Slack message, or a watermark link in a public forum targeting Dify administrators. Social engineering pretexts include "Your workflow configuration has expired — log in to continue" or "Review the new LLM integration."

Step 4 — Execution: The victim clicks the link. Their browser sends a request to the vulnerable Dify instance. The AppInitializer processes the request, completes the OAuth handshake (if a valid code is present), and issues a 302 redirect to https://evil.example.com/steal. The browser follows the redirect, making a request to the attacker's server. Critically, the attacker's page now receives:

• The Referer header containing the original Dify URL (which may include an OAuth authorization code or session state).
• Any cookies scoped to evil.example.com that the attacker's page sets (note: Dify session cookies are not forwarded cross-domain, so direct session hijacking via cookies is not possible; however, the code parameter in the referer can be exchanged for tokens).
• The victim is presented with a phishing page that harvests their Dify credentials or API keys.

Step 5 — Post-exploitation: The attacker uses any stolen OAuth codes, credentials, or API keys to: access the victim's Dify workflows, extract LLM API keys embedded in prompts, manipulate AI model configurations, or pivot to connected downstream services. The open redirect itself may also be used as an open proxy for malware distribution — the victim's browser is a trusted origin for the Dify domain, so any content maliciously hosted on trusted infrastructure could be served from the legitimate Dify origin.

Impact Assessment

Business impact: Medium. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N reflects: low confidentiality and integrity impact, no availability impact. The attack requires user interaction (a click), but the network attack vector and zero privileges required make it a viable phishing tool.

Affected systems: All Dify AI Workflow installations that expose the OAuth callback endpoint. This includes self-hosted Docker deployments, Kubernetes installations, and Dify Cloud instances (the latter being at lower risk if the cloud provider has centralized patching).

Blast radius: The primary impact is credential theft and phishing enablement. However, because Dify is an LLM orchestration platform, a compromised administrator account grants access to: LLM API keys (OpenAI, Anthropic, etc.), workflow logic, connected data sources (databases, APIs), and the ability to poison or exfiltrate AI-generated responses used by downstream business applications. This substantially raises the real-world impact beyond a typical open redirect.

EPSS context: EPSS score of 0.00243 (15.6th percentile) indicates very low probability of exploitation in the wild; however, this reflects historical data and does not discount the utility of this vulnerability for targeted phishing against Dify installations.

Detection Guidance

Sigma Rule

title: Dify OAuth Open Redirect - Suspicious oauth_redirect_url Parameter
id: 6f8e33d2-7a3c-4b1e-9c2f-5d6e8a0b1c2d
status: experimental
description: Detects requests to Dify OAuth callback endpoints containing an external oauth_redirect_url parameter, indicating possible exploitation of CVE-2026-18266.
author: Valtersit Threat Intelligence
date: 2026/06/01
logsource:
  category: webserver
  product: apache
  service: access_log
detection:
  selection:
    cs-uri-query|contains:
      - "oauth_redirect_url="
      - "oauth%5Fredirect%5Furl="
    cs-uri-stem|contains:
      - "/oauth/callback"
      - "/oauth/redirect"
  filter_internal:
    cs-uri-query|contains:
      - "oauth_redirect_url=https://"
      - "oauth_redirect_url=http://"
  filter_local:
    cs-uri-query|contains:
      - "localhost"
      - "127.0.0.1"
      - "10."
      - "192.168."
  condition: selection and filter_internal and not filter_local
falsepositives:
  - Legitimate multi-tenant OAuth configurations where admins intentionally set external redirect URLs
level: medium
tags:
  - attack.t1566
  - cve.2026-18266

YARA Rule

rule CVE_2026_18266_Dify_OAuth_Open_Redirect
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects exploitation indicators for CVE-2026-18266 - Dify oauth_redirect_url open redirect"
        date = "2026-06-01"
        cve = "CVE-2026-18266"
        severity = "medium"
    strings:
        $s1 = "oauth_redirect_url" ascii wide
        $s2 = "oauth_redirect_url=" ascii wide
        // External URL patterns - not localhost or internal IPs
        $s3 = /oauth_redirect_url=[^\s&"']*https?:\/\/(?!localhost|127\.0\.0\.1|10\.|192\.168\.)[^\s&"']*/ ascii
        $s4 = "AppInitializer" ascii wide
        $s5 = "/oauth/callback" ascii wide
        $s6 = "Location: https://" ascii wide
        // Redirect Location header to a non-Dify domain
        $s7 = /Location:\s*https?:\/\/(?!.*dify)[^\r\n]+/ ascii
    condition:
        (uint16(0) == 0x5A4D or filesize > 100KB) and
        (($s1 or $s2) and $s3) and
        ($s4 or $s5 or ($s6 and $s7))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-18266 Dify OAuth Open Redirect Attempt"; flow:established,to_server; http.uri; content:"/oauth/callback"; nocase; http.uri; content:"oauth_redirect_url"; nocase; pcre:"/oauth_redirect_url=[^\s&]*https?:\/\/(?!localhost|127\.0\.0\.1|10\.|192\.168\.)/Ui"; sid:202618266; rev:1; metadata:cve CVE-2026-18266, attack_target web_server, deployment perimeter, tag oauth-open-redirect; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-18266; classtype:web-application-attack; priority:2;)

Elastic Detection

// Elastic EQL rule to detect Dify OAuth open redirect exploitation
sequence by host.name with maxspan=5m
  [network where event.action == "connection_attempted" and
   destination.port in (80, 443) and
   url.full like "*oauth*" and
   url.full like "*oauth_redirect_url*" and
   not url.full like "*localhost*" and
   not url.full like "*127.0.0.1*"]
  [http where true and
   http.response.status_code == 302 and
   http.response.headers.location like "https://*" and
   not http.response.headers.location like "*dify*"]

Splunk SPL Query

index=web sourcetype=access_combined
  uri_path="/oauth/callback" OR uri_path="/oauth/redirect"
  uri_query="*oauth_redirect_url*"
  | rex field=uri_query "oauth_redirect_url=(?<redirect_url>[^\s&]+)"
  | eval redirect_host=lower(replace(redirect_url, "^(https?://)", ""))
  | eval redirect_host=split(redirect_host, "/")[0]
  | where redirect_host NOT IN ("localhost", "127.0.0.1", "10.*", "192.168.*", "*.dify.*")
  | stats count by src_ip, dest_host, redirect_host, _time
  | sort -count

Wazuh OSSEC Rule

<group name="dify,oauth,cve-2026-18266,">
  <rule id="202618" level="10" frequency="5" timeframe="60">
    <if_matched_sid>31540</if_matched_sid>
    <field name="uri" type="pcre2">(/oauth/callback|/oauth/redirect)</field>
    <field name="url_query" type="pcre2">oauth_redirect_url=</field>
    <description>Dify OAuth callback with oauth_redirect_url parameter detected - possible CVE-2026-18266 exploitation</description>
    <group>web_application_attack,oauth_open_redirect,cve2026,</group>
    <mitre>
      <id>T1566</id>
    </mitre>
    <var name="alert_level">10</var>
  </rule>

  <rule id="202619" level="12" frequency="10" timeframe="300">
    <if_sid>202618</if_sid>
    <field name="url_query" type="pcre2">oauth_redirect_url=(https?://)?(?!(localhost|127\.0\.0\.1|10\.|192\.168\.|.*\.dify\.))</field>
    <description>Dify OAuth redirect to external domain - likely CVE-2026-18266 exploitation attempt</description>
    <group>web_application_attack,oauth_open_redirect,cve2026,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The vendor (Dify / LangGenius) has not released a security advisory or fixed version at the time of writing.

1) Immediate mitigations:

• Disable OAuth-based login flows on public-facing Dify instances if they are not strictly required for business operations. If OAuth is needed, restrict the callback endpoint to internal network access only via firewall rules.
• Apply a reverse proxy validation rule. Place an Nginx or HAProxy in front of Dify and add a rule that rejects any request to the OAuth callback containing an oauth_redirect_url parameter pointing to an external domain. Example Nginx rule:

if ($request_uri ~* "^/oauth/callback.*oauth_redirect_url=(https?://)(?!localhost|127\.0\.0\.1|internal\.domain)") {
    return 403;
}

• Monitor logs for abnormal oauth_redirect_url values using the detection rules provided above.
• Educate users (especially Dify administrators/developers) about phishing links containing Dify OAuth callback URLs.

2) Patch/upgrade steps:

• Monitor the Dify GitHub repository (github.com/langgenius/dify) for security advisories and the main branch for a fix. The patch is expected to add a strict allowlist validation for the oauth_redirect_url host.
• As a temporary code-level workaround for self-hosted installations, patch the AppInitializer component to enforce that oauth_redirect_url resolves to the same origin or a configured allowlist. Apply this as a hotfix via a patch file or a custom fork.
• No version-specific upgrade path exists until the vendor publishes a fixed release.

3) Long-term hardening:

• Enable SameSite=Strict and Secure flags on all session cookies for the Dify application.
• Ensure reverse proxies strip or validate all Referer and Origin headers.
• Subscribe to Dify's security mailing list or GitHub watch notifications.
• Consider implementing Web Application Firewall (WAF) rules that detect open redirect patterns across all endpoints.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-18266
2. Dify GitHub Repository: https://github.com/langgenius/dify
3. Zero Day Initiative Advisory (ZDI-CAN-29196): https://www.zerodayinitiative.com/advisories/
4. CWE-601 Open Redirect: https://cwe.mitre.org/data/definitions/601.html
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild evidence: Not known to CISA KEV (NO). No public exploit code or Nuclei template exists. EPSS score of 0.00243 indicates a low probability of active exploitation at current time.