CVE-2026-85022
lowA vulnerability was identified in langgenius dify 1.13.0.
A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirect_url leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://gist.github.com/TrebledJ/0e8466e5c39a6fb7dca8a3acdfbe2ddc#file-cvd_dify_vuln2_2026... cna@vuldb.com
- https://github.com/langgenius/dify/ cna@vuldb.com
- https://github.com/langgenius/dify/security/advisories/GHSA-7vhm-2r2w-hgg4 cna@vuldb.com
- https://huntr.com/bounties/184a858e-05b2-4a06-bb32-2d77cbc363fe cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-85022 cna@vuldb.com
- https://vuldb.com/submit/880602 cna@vuldb.com
- https://vuldb.com/vuln/398289 cna@vuldb.com
- https://vuldb.com/vuln/398289/cti cna@vuldb.com