CVE-2026-28288: Dify Information Disclosure Vulnerability

CVE-2026-28288 Overview

CVE-2026-28288 is an information disclosure vulnerability in Dify, an open-source LLM (Large Language Model) application development platform. The vulnerability allows attackers to enumerate email addresses registered with Dify by observing differences in API responses between existing and non-existent accounts. This information exposure flaw can be leveraged for targeted attacks against known users of the platform.

Critical Impact

Attackers can enumerate valid email addresses registered on Dify instances, enabling targeted phishing campaigns, credential stuffing attacks, and social engineering against confirmed platform users.

Affected Products

• Dify versions prior to 1.9.0
• Dify open-source LLM app development platform (all installations before patch)

Discovery Timeline

• 2026-02-27 - CVE CVE-2026-28288 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-28288

Vulnerability Analysis

This vulnerability is classified under CWE-204 (Observable Response Discrepancy), which occurs when different responses from a system reveal whether a specific resource or user exists. In the case of Dify, the API endpoints responsible for account-related operations return distinguishable responses based on whether an email address is registered in the system.

The vulnerability exists in the authentication and account management API endpoints. When an attacker queries the API with an email address, the system provides different response patterns, timing, or error messages depending on whether the account exists. This allows systematic enumeration of valid email addresses without requiring authentication.

Root Cause

The root cause stems from inadequate response normalization in the Dify API. When handling requests involving email addresses, the application fails to provide uniform responses regardless of account existence. This observable discrepancy violates the security principle of not revealing whether specific users exist in the system.

The implementation likely returns specific error messages like "user not found" for non-existent accounts versus different messages or status codes for existing accounts, making enumeration straightforward for attackers.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending automated requests to the Dify API with a list of email addresses and analyzing the responses. The attack methodology involves:

1. Preparing a list of potential email addresses (harvested from data breaches, company directories, or generated patterns)
2. Sending account lookup or authentication requests to the Dify API
3. Comparing response content, status codes, timing, or error messages
4. Cataloging confirmed email addresses based on differential responses
5. Using confirmed accounts for secondary attacks such as credential stuffing or phishing

This vulnerability is particularly concerning for organizations using Dify in production environments where user privacy is paramount.

Detection Methods for CVE-2026-28288

Indicators of Compromise

• High volume of authentication or account lookup API requests from single IP addresses
• Sequential or patterned email address queries to account-related endpoints
• Unusual traffic spikes to login, password reset, or account verification endpoints
• Failed authentication attempts across multiple unique email addresses

Detection Strategies

• Implement rate limiting detection on account enumeration-sensitive endpoints
• Monitor for anomalous request patterns targeting user lookup functionality
• Deploy web application firewall (WAF) rules to detect enumeration attempts
• Analyze API logs for bulk email validation requests from suspicious sources

Monitoring Recommendations

• Enable detailed logging for all authentication and account-related API endpoints
• Set up alerts for excessive failed lookups from single source IPs
• Monitor for tools commonly used in enumeration attacks (e.g., Burp Suite, custom scripts)
• Track API response time anomalies that may indicate enumeration attempts

How to Mitigate CVE-2026-28288

Immediate Actions Required

• Upgrade Dify to version 1.9.0 or later immediately
• Implement rate limiting on authentication and account lookup endpoints
• Review API access logs for potential prior exploitation
• Consider enabling CAPTCHA or similar anti-automation measures on sensitive endpoints

Patch Information

The vulnerability has been fixed in Dify version 1.9.0. Organizations should upgrade to this version or later to remediate the issue. The fix normalizes API responses to prevent differentiation between existing and non-existing accounts.

For detailed patch information, refer to the GitHub Security Advisory GHSA-9qpf-wcv3-w3qx and the related GitHub Issue #24323.

Workarounds

• Deploy a reverse proxy or WAF to implement rate limiting on account-related endpoints
• Implement IP-based blocking for suspicious enumeration activity
• Add artificial delays to authentication responses to mask timing differences
• Consider temporarily restricting public access to account verification endpoints until patching is complete

# Example: Rate limiting configuration using nginx
# Add to your Dify nginx configuration

limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=5r/m;

location /api/v1/auth {
    limit_req zone=auth_limit burst=2 nodelay;
    limit_req_status 429;
    proxy_pass http://dify_backend;
}

location /api/v1/account {
    limit_req zone=auth_limit burst=2 nodelay;
    limit_req_status 429;
    proxy_pass http://dify_backend;
}