Description
A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirect_url leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-03
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in langgenius dify version 1.13.0 allows an attacker to manipulate the redirect_url argument passed to the router.replace function in the WebApp Sign‑In module. This manipulation results in cross site scripting that can execute arbitrary JavaScript within the victim’s browser session.

Affected Systems

langgenius dify version 1.13.0

Risk and Exploitability

The CVSS score of 5.1 classifies the vulnerability as moderate severity. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog. The attacker can perform the exploit remotely by sending a crafted redirect_url to the public sign‑in endpoint; exploitation does not require prior authentication or elevated privileges. Publicly available exploit code suggests the flaw is trivial to abuse once a malicious payload is delivered.

Generated by OpenCVE AI on September 3, 2026 at 10:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade langgenius dify to a version that includes the router.replace input validation patch.
  • If an upgrade is not immediately possible, restrict the redirect_url parameter to a whitelist of approved domains or enforce strict validation before invoking router.replace.
  • Deploy a Content Security Policy that blocks inline scripts and limits script sources to reduce the impact of any injected code.

Generated by OpenCVE AI on September 3, 2026 at 10:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 01:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirect_url leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting
First Time appeared Langgenius
Langgenius dify
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:langgenius:dify:*:*:*:*:*:*:*:*
Vendors & Products Langgenius
Langgenius dify
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Langgenius Dify
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-03T13:25:08.503Z

Reserved: 2026-09-02T19:47:18.388Z

Link: CVE-2026-85022

cve-icon Vulnrichment

Updated: 2026-09-03T13:24:59.970Z

cve-icon NVD

Status : Deferred

Published: 2026-09-03T13:06:19.410

Modified: 2026-09-03T17:25:25.113

Link: CVE-2026-85022

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T10:30:12Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')