What is CVE-2026-18266?

CVE-2026-18266 is a medium-severity vulnerability in Langgenius Dify, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 5.4/10. Published 2026-07-29.

How severe is CVE-2026-18266?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Open Redirect in Langgenius Dify

CVE-2026-18266

Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Dify. User interaction is required to exploit this vulnerability in…

Vulnerability class: Open Redirect

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N.

Affected products

Langgenius Dify — versions 1.11.4

Weakness classification (CWE)

CWE-601 — URL Redirection to Untrusted Site (Open Redirect)

References

zdi-disclosures@trendmicro.com (x_research-advisory)

Frequently asked questions

What is CVE-2026-18266?: CVE-2026-18266 is a medium-severity vulnerability in Langgenius Dify, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 5.4/10. Published 2026-07-29.
How severe is CVE-2026-18266?: Medium severity. CVSS v3 base score is 5.4 out of 10.