CVE-2026-111988: dyad-sh dyad OAuth CSRF Vulnerability

CVE-2026-111988 Overview

CVE-2026-111988 is a cross-site request forgery (CSRF) vulnerability [CWE-352] in the dyad-sh dyad application through version 1.16.0. The flaw resides in the OAuth Callback Handler component, which fails to properly authenticate deep-link callbacks returning from external identity providers. An unauthenticated remote attacker can craft a malicious link that, when followed by a victim, triggers an unsolicited OAuth connection flow on the victim's dyad client. The maintainers addressed the issue in release 1.17.0-beta.1 via commit 39fbae87b38573616a1a3b152cdb292787bb1109.

Critical Impact
An attacker can trick a dyad user into completing an unsolicited OAuth connection, allowing the attacker-controlled account to be linked to third-party integrations such as Neon and Supabase.

Affected Products

dyad-sh dyad versions up to and including 1.16.0
NeonConnector component (OAuth deep-link callback)
SupabaseConnector component (OAuth deep-link callback)

Discovery Timeline

2026-10-18 - CVE-2026-111988 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-111988

Vulnerability Analysis

The dyad application accepts OAuth callbacks delivered via deep links to complete connection flows with third-party providers. Prior to the fix, the client processed inbound callbacks even when no connection flow had been initiated by the user. This behavior, implemented through a hook named useUnsolicitedConnectionReturn, created a classic CSRF primitive against the desktop client. Any party able to deliver a crafted deep link to the victim could induce the client to treat it as a legitimate OAuth return.

Because the callback carries provider tokens or authorization data, an attacker who initiates an OAuth flow from their own browser and then forwards the resulting callback URL to a victim can cause the victim's dyad instance to bind the attacker's third-party account. User interaction is required to open the link, but no authentication on the attacker's side against dyad is needed.

Root Cause

The underlying cause is missing origin validation and absent state binding between the client-initiated OAuth request and the inbound callback. The removed useUnsolicitedConnectionReturn path accepted callbacks without verifying that the local client had started a corresponding flow, violating standard OAuth 2.0 CSRF mitigation guidance that requires a cryptographically bound state parameter.

Attack Vector

The attack is remote and requires user interaction. An attacker crafts a deep-link URL that mimics a legitimate OAuth callback for Neon or Supabase and delivers it through email, chat, or a web page. When the victim opens the link, the dyad client processes it as a connection return.

text

   cancelConnectionFlow,
   startConnectionFlow,
   useConnectionFlow,
-  useUnsolicitedConnectionReturn,
 } from "@/hooks/useConnectionFlow";
+import { buildOAuthLoginUrl } from "@/connection_flow/oauth_deep_link";

Source: GitHub commit 39fbae8. The patch removes the unsolicited-return hook from both NeonConnector.tsx and SupabaseConnector.tsx and routes callbacks through an authenticated buildOAuthLoginUrl helper.

Detection Methods for CVE-2026-111988

Indicators of Compromise

Unexpected Neon or Supabase account connections appearing in a user's dyad workspace without a corresponding user-initiated flow.
Deep-link invocations of the dyad custom URI scheme originating from untrusted sources such as email clients, messaging apps, or arbitrary web pages.
Audit log entries from Neon or Supabase showing OAuth consent grants that do not match the user's recorded activity.

Detection Strategies

Review third-party provider audit logs (Neon, Supabase) for authorization grants that cannot be correlated to a legitimate dyad session.
Inspect endpoint telemetry for process launches of the dyad client triggered by browser or mail-client parent processes handling custom URI schemes.
Hunt for inbound links containing the dyad deep-link scheme in email gateways and web proxy logs.

Monitoring Recommendations

Alert on changes to connected integrations within dyad project configuration files.
Monitor OAuth consent and refresh-token events for Neon and Supabase accounts tied to developer workstations.
Track installations of dyad versions at or below 1.16.0 across managed developer endpoints.

How to Mitigate CVE-2026-111988

Immediate Actions Required

Upgrade dyad to 1.17.0-beta.1 or later on all developer workstations.
Review all currently connected Neon and Supabase integrations in dyad and revoke any that cannot be attributed to a user-initiated connection.
Rotate OAuth tokens and credentials for third-party providers that were linked while running a vulnerable version.

Patch Information

The fix is delivered in commit 39fbae87b38573616a1a3b152cdb292787bb1109 and released in v1.17.0-beta.1. The patch removes the useUnsolicitedConnectionReturn hook and introduces buildOAuthLoginUrl to authenticate OAuth deep-link callbacks. See the GitHub Security Advisory GHSA-pqj5-w36j-2839, Pull Request #4433, and the v1.17.0-beta.1 release notes.

Workarounds

Instruct users not to open dyad deep links received from untrusted sources until the client is upgraded.
Where supported, disable or unregister the dyad custom URI scheme handler on endpoints that cannot be immediately patched.
Restrict OAuth application scopes in Neon and Supabase to the minimum required, limiting the impact of any unsolicited connection.

bash

# Verify installed dyad version and upgrade
dyad --version
# If version <= 1.16.0, upgrade to the patched release
npm install -g dyad@1.17.0-beta.1