Dify AI Workflow Vulnerability Allows Sensitive Information Disclosure via Open Redirect
A Dify AI Workflow open redirect vulnerability (ZDI-26-452) allows remote attackers to disclose sensitive information by tricking users into visiting a malicious link.
The Zero Day Initiative (ZDI) has disclosed a critical open redirect vulnerability, identified as ZDI-26-452, affecting Dify AI Workflow installations. This flaw, with a CVSS score of 5.4, permits remote attackers to potentially disclose sensitive information on compromised systems.
Exploitation of this vulnerability requires a degree of user interaction. Specifically, a victim must be enticed to click on a specially crafted malicious link. This link would then initiate a redirection process that an attacker can manipulate.
The root cause of the vulnerability lies within the OAuth flow handling mechanism in the AppInitializer component of Dify. Attackers can exploit a weakness in this component to force an unintended redirection to a website controlled by the attacker. This redirection can then be used to exfiltrate sensitive data associated with the application's context.
While the exact nature of the sensitive information that can be disclosed is not detailed in the advisory, the mechanism allows an attacker to leverage the application's trust to potentially access or reveal data that would otherwise be protected.
TrendAI Research's David Fiser and Alfredo Oliveira are credited with discovering and reporting this vulnerability. The disclosure timeline indicates that the vulnerability was reported to the vendor on March 25, 2026, with the coordinated public release of the advisory occurring on July 23, 2026.
Fortunately, the vendor, Dify, has already addressed this issue. A pull request on their GitHub repository, specifically PR #38864, details the fix. Users are strongly advised to update their Dify installations to the latest version to mitigate this risk.
This vulnerability highlights the ongoing security challenges associated with complex AI workflow platforms. As these tools become more integrated into business processes, the potential impact of vulnerabilities within their authentication and redirection mechanisms increases significantly.
Organizations utilizing Dify AI Workflow should prioritize applying the available patch. Furthermore, security teams should remain vigilant for any signs of exploitation, particularly phishing attempts that might leverage open redirect vulnerabilities to lead users to malicious sites.