CVE-2026-53989CWE-601

CVE-2026-53989

Medium · published September 30, 2026

CVSS v3.1
4.7
EPSS
0%
Percentile
16.5
In the wild
Unconfirmed
What it is

Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers to redirect authenticated users to attacker-controlled sites by injecting an unvalidated redirect query parameter. Attackers can craft a malicious link targeting the OIDC callback flow to capture authorization codes via the Referer header and conduct follow-up credential phishing against any Dockhand account after a legitimate login.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00258 · 16.5th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-09-30T00:17Z
References (2)
https://github.com/Finsys/dockhand/releases/tag/v1.0.36 · [email protected]https://www.vulncheck.com/advisories/dockhand-open-redirect-via-oidc-initiation-endpoint · [email protected]
EPSS history
Timeline
  • 01 OCT 03:47Z
    EPSS moved — → 0%
    epss
  • 29 SEP 19:42Z
    Dockhand < 1.0.36 Open Redirect via OIDC Initiation Endpoint
    cvelistv5