CVE-2026-85022 langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting

A cross-site scripting (XSS) vulnerability affects the WebApp Sign-In component of langgenius dify 1.13.0 , specifically in the router.replace function within web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx. Manipulating the redirect_url argument enables remote attackers...