Observable Response Discrepancy in Dify - CVE-2026-28288
Published: July 27, 2026
Vulnerability identifier: #VU139803
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-28288
CWE-ID: CWE-204
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: LangGenius
Affected software:
Dify
Dify
Detailed vulnerability description
The vulnerability allows a remote attacker to enumerate registered email addresses.
The vulnerability exists due to observable response discrepancy in the /console/api/login endpoint when handling login requests. A remote attacker can send crafted login requests with candidate email addresses to enumerate registered email addresses.
The issue can be identified by differences in API responses for existing accounts versus non-existent accounts.
How to mitigate CVE-2026-28288
Install security update from vendor's website.