CVE-2026-53989

MEDIUM 4.7

Dockhand < 1.0.36 Open Redirect via OIDC Initiation Endpoint

CVSS Score

4.7

EPSS Score

0.0%

EPSS Percentile

0th

Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers to redirect authenticated users to attacker-controlled sites by injecting an unvalidated redirect query parameter. Attackers can craft a malicious link targeting the OIDC callback flow to capture authorization codes via the Referer header and conduct follow-up credential phishing against any Dockhand account after a legitimate login.

CWE	CWE-601
Vendor	finsys
Product	dockhand
Published	Sep 29, 2026
Last Updated	Sep 29, 2026

Stay Ahead of the Next One

Get instant alerts for finsys dockhand

Be the first to know when new medium vulnerabilities affecting finsys dockhand are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

Finsys / dockhand

0 < 1.0.36

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Finsys/dockhand/releases/tag/v1.0.36 vulncheck.com: https://www.vulncheck.com/advisories/dockhand-open-redirect-via-oidc-initiation-endpoint

Credits

Katriel Moses VulnCheck