CVE-2026-18266: Dify AI Open Redirect Vulnerability

CVE-2026-18266 Overview

CVE-2026-18266 is an open redirect vulnerability in the Dify AI Workflow platform. The flaw resides in the OAuth flow handling within the AppInitializer component, where the oauth_redirect_url parameter is not properly validated. Remote attackers can craft malicious links that force authenticated users to be redirected to attacker-controlled domains after visiting a crafted page or opening a malicious file. This vulnerability is tracked as CWE-601: URL Redirection to Untrusted Site and was disclosed through the Zero Day Initiative Advisory ZDI-26-452 as ZDI-CAN-29196.

Critical Impact
Attackers can leverage the open redirect to disclose sensitive information, phish credentials, or serve malicious content in the context of the Dify application.

Affected Products

Dify AI Workflow platform (see ZDI-26-452 for version details)
Deployments exposing the AppInitializer OAuth flow
Self-hosted and cloud-hosted Dify instances handling oauth_redirect_url

Discovery Timeline

2026-07-29 - CVE-2026-18266 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-18266

Vulnerability Analysis

The vulnerability exists in the OAuth authorization flow implemented by the AppInitializer component in Dify. During OAuth negotiation, the application accepts an oauth_redirect_url parameter that determines where the user is sent after authentication. The component does not sufficiently validate that this URL points to an approved destination. An attacker can supply an arbitrary external URL, and the application honors that value at the redirection step.

Because the redirect originates from the trusted Dify domain, users and security controls treat the initial link as legitimate. Attackers commonly abuse this pattern to phish OAuth tokens, harvest credentials, or deliver malicious payloads under the trust of the application's origin. Successful exploitation requires user interaction, such as clicking a crafted link.

Root Cause

The root cause is insufficient validation of user-controlled URL input passed to the redirection routine in AppInitializer. The OAuth handler trusts the oauth_redirect_url value without verifying it against an allowlist of permitted hosts or path patterns. This maps directly to CWE-601: URL Redirection to Untrusted Site.

Attack Vector

The attack is delivered over the network. An attacker crafts a Dify authentication URL where oauth_redirect_url points to an attacker-controlled host. The victim clicks the link, authenticates through Dify, and is redirected to the malicious site, which may mimic the Dify UI, capture OAuth artifacts, or serve exploit content. No privileges are required on the attacker side, but user interaction is required.

The vulnerability manifests when the OAuth callback logic constructs a redirection response using an unvalidated external URL. Refer to the Zero Day Initiative advisory for additional technical detail on the affected code path.

Detection Methods for CVE-2026-18266

Indicators of Compromise

HTTP requests to Dify OAuth endpoints containing oauth_redirect_url parameters that reference external, non-allowlisted domains.
Web server or reverse-proxy logs showing 3xx redirect responses from the AppInitializer OAuth flow to unfamiliar hosts.
User reports of being redirected from a Dify login flow to unexpected pages or credential prompts.

Detection Strategies

Parse application access logs and alert on oauth_redirect_url values whose host component is not in the approved list.
Correlate OAuth initiation requests with subsequent outbound referrer traffic to detect redirection chains that leave the Dify domain.
Deploy web application firewall rules that inspect and score external redirect targets in OAuth query strings.

Monitoring Recommendations

Continuously monitor Dify authentication endpoints for anomalous query string patterns and encoded URL payloads.
Track user-agent and geolocation anomalies during OAuth handshakes to spot targeted phishing campaigns using this flaw.
Feed Dify access logs into a centralized analytics pipeline so redirect targets can be searched retroactively when new indicators surface.

How to Mitigate CVE-2026-18266

Immediate Actions Required

Apply the vendor patch referenced in the ZDI-26-452 advisory as soon as it is available for your Dify deployment.
Restrict access to Dify authentication endpoints behind a reverse proxy that validates redirect parameters against an allowlist.
Notify users of the phishing risk and instruct them to verify the destination domain after any Dify OAuth flow.

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-26-452 for coordinated disclosure details. Administrators should upgrade to the Dify release that addresses the oauth_redirect_url validation in the AppInitializer component and confirm the fix is present in production environments before reopening external access.

Workarounds

Configure a reverse proxy or WAF rule that strips or rejects oauth_redirect_url values whose host does not match the approved Dify domain.
Enforce a static allowlist of permitted redirect destinations in application configuration until the patch is deployed.
Disable or gate external OAuth callback flows for privileged accounts to reduce exposure to phishing chains.

bash

# Example NGINX rule to block external oauth_redirect_url values
if ($arg_oauth_redirect_url !~* "^https://dify\.example\.com/") {
    return 400;
}