The flaw resides in the OAuth Callback Handler of the dyad application, where an attacker can send crafted requests that the handler blindly processes. By omitting authentication or CSRF tokens and manipulating input, the attacker can force the server to perform actions on behalf of an authenticated user. This leads to unauthorized privileged actions, violating confidentiality and integrity. The weakness is identified as Cross‑Site Request Forgery (CWE‑352) and Missing Authorization (CWE‑862).

The vulnerability impacts the dyad application distributed by dyad‑sh. All releases up to and including version 1.16.0 are affected. Version 1.17.0‑beta.1 includes the fix, so upgrading to that or a newer release resolves the issue.

With a CVSS score of 5.3, the flaw is considered moderate. The EPSS score is not available, so there is no precise estimate of exploitation likelihood; however, the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely through the OAuth Callback endpoint by sending a forged request that bypasses CSRF protection and authorization checks. No elevated privileges are required beyond those of the target user.