UpHeron
All vulnerabilities

Servers and applications

CVE-2025-58747

Dify MCP OAuth Flow Vulnerable to XSS

Severity
Low 2.0
Published
17 Oct 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.8.0, 1.9.2
Also known as
GHSA-9jch-j9qf-vqfw
Sources
NVD, Project advisories (GitHub)

Description

Dify is an LLM application development platform. In Dify versions through 1.9.1, the MCP OAuth component is vulnerable to cross-site scripting when a victim connects to an attacker-controlled remote MCP server. The vulnerability exists in the OAuth flow implementation where the authorization_url provided by a remote MCP server is directly passed to window.open without validation or sanitization.…

Affected software

SoftwareAffected versions
DifyServers and applications · cpe:a:langgenius:dify
  • Every version before 1.9.2
DifyServers and applications · github:langgenius/dify
  • Every version before 1.8.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-58747
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-58747
  • GitHub Advisory Database https://github.com/advisories/GHSA-9jch-j9qf-vqfw
  • github.com https://github.com/langgenius/dify/security/advisories/GHSA-9jch-j9qf-vqfw