CVE-2026-85022

Name of the Vulnerable Software and Affected Versions langgenius dify version 1.13.0

Description Cross site scripting occurs in the WebApp Sign-In component within the router.replace() function of the file web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx. A remote attacker can trigger this issue by manipulating the redirect url argument.

Recommendations As a temporary workaround, restrict the use of the redirect url argument in the WebApp Sign-In component until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.