Description

A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirect_url leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-03T13:06:19.410Z",
  "pubdate": "2026-09-03T13:06:19.410Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in langgenius dify version 1.13.0 within the WebApp Sign-In component.\nThe vulnerability originates from improper sanitization of the redirect_url argument, which is processed by the router.replace function in web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx.\nAn unauthenticated, remote attacker can exploit this flaw by supplying a malicious URL containing JavaScript payloads, leading to arbitrary code execution within the context of the user's browser session.\nThe impact includes potential session hijacking, unauthorized actions performed on behalf of the user, and the exfiltration of sensitive information.\nThis vulnerability is critical due to the availability of public exploits and the absence of a vendor-provided fix, leaving deployments exposed to remote exploitation.",
  "technicalDetails": "The vulnerability resides in the front-end routing logic of the WebApp Sign-In component in langgenius dify 1.13.0. Specifically, the file web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx fails to validate or sanitize user-supplied input provided via the redirect_url parameter before passing it to the router.replace function.\nThe router.replace function is intended to handle navigation within the Next.js application framework. When the redirect_url parameter is manipulated to contain a 'javascript:' pseudo-protocol URI, the application incorrectly interprets this as a navigation target. Because the application logic does not perform allow-listing of domains or protocol verification, the browser executes the injected JavaScript content upon processing the navigation command.\nThe attack flow begins when an attacker crafts a malicious link or trigger containing a specially formed redirect_url. The attacker delivers this URL to a target user, often through phishing, social engineering, or a compromised link on a trusted platform. When the user interacts with the link and is directed to the vulnerable Dify authentication endpoint, the application extracts the unsanitized redirect_url.\nUpon reaching the vulnerable component, the router.replace logic interprets the 'javascript:' payload. Consequently, the user's browser executes the script in the security context of the Dify application domain. This allows for full access to the victim's session cookies, local storage, and the Document Object Model (DOM) of the page.\nThis vulnerability is classified as Reflected XSS. It does not require prior authentication, as the affected component is part of the sign-in flow and is publicly accessible via the network. There are no privilege requirements, and the exploit can be performed remotely by any actor capable of coercing a user into navigating to the crafted URL.\nPost-exploitation, an attacker can perform actions such as credential theft, session token interception, or redirecting the user to a malicious site to harvest further information. Given the public availability of exploit vectors, the risk to organizations utilizing this version of Dify is significant."
}