A crafted dyad:// link could connect a Dyad user's apps to an attacker's Supabase or Neon account

CVE-2026-111988 was published October 18, 2026. The NVD record has status Received, so NVD has not analyzed this CVE yet. The description it carries from VulDB, the CNA, says Dyad up to 1.16.0 has a cross-site request forgery flaw in its OAuth callback handler that can be triggered remotely, and that upgrading to 1.17.0-beta.1 resolves it. VulDB names the patch commit 39fbae87b38573616a1a3b152cdb292787bb1109. VulDB (the CNA) assigns CWE-352 and CWE-862 and rates it CVSS 3.1 score 4.3, severity Medium, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. That v1.17.0-beta.1 prerelease was published September 24, 2026 (Pacific time). v1.17.0, published September 28, 2026 (Pacific time), is the first stable release with the fix. Both releases contain pull request #4433 and that commit.

Dyad's own advisory, GHSA-pqj5-w36j-2839, was published September 28, 2026 and rates the same bug High, CVSS 3.1 score 8.3. It lists CWE-346 and CWE-352. It says Dyad accepted the dyad://supabase-oauth-return and dyad://neon-oauth-return deep links without checking that they belonged to a connection the user had started, and read the access token, refresh token, and expiry straight from the URL. Dyad accepted any Supabase token that Supabase considered valid, whatever account it belonged to, and added the attacker's Supabase organization without asking. It also overwrote an existing Neon connection. The only prompt was the operating system's "Open Dyad?" dialog.

The advisory says databases the victim creates or connects after that live in the attacker's account, so the attacker can read and change that app data, which may include end users' personal information, and can break a working connection. It says the attacker does not get the victim's own Supabase or Neon credentials or existing data. Versions through 1.16.0 are affected. The fix first shipped in the v1.17.0-beta.1 prerelease on September 24, 2026 (Pacific time). v1.17.0, published September 28, 2026 (Pacific time), is the first stable release with the fix, and both releases contain pull request #4433 and commit 39fbae87b38573616a1a3b152cdb292787bb1109. The advisory says the fix shipped in 1.17.0, together with an update to Dyad's hosted OAuth proxies: each connection now carries a single-use flow identifier, and callbacks that are missing, unknown, expired, or already used are rejected. If you may have opened such a link, upgrade, disconnect and reconnect Supabase and Neon, and check that the projects and organizations Dyad shows belong to you.