This vulnerability in LangGenius Dify (version 1.11.4) involves an open redirect in the OAuth flow, specifically in the AppInitializer component's oauth_redirect_url parameter. An attacker can craft a URL that forces the application to redirect users to an untrusted external site serving malicious content. Exploitation requires user interaction, such as clicking a malicious link or opening a malicious file. The vulnerability can be leveraged to disclose sensitive information related to the application. It is tracked as CVE-2026-18266 and was reported by ZDI as ZDI-CAN-29196.

Successful exploitation can lead to information disclosure in the context of the affected application. The vulnerability does not allow privilege escalation or denial of service but can be used to trick users into visiting malicious sites, potentially exposing sensitive data. The CVSS base score of 5.4 reflects a medium impact with low complexity and no privileges required, but user interaction is necessary.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Until a patch is available, users should exercise caution with OAuth redirect URLs and avoid interacting with untrusted links or files that could trigger the redirect.