{"id":"CVE-2026-53989","published":"2026-09-29T20:17:20.593","lastModified":"2026-09-29T21:17:20.697","description":"Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers to redirect authenticated users to attacker-controlled sites by injecting an unvalidated redirect query parameter. Attackers can craft a malicious link targeting the OIDC callback flow to capture authorization codes via the Referer header and conduct follow-up credential phishing against any Dockhand account after a legitimate login.","cvssScore":4.7,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","cwes":["CWE-601"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Finsys/dockhand/releases/tag/v1.0.36","tags":[]},{"url":"https://www.vulncheck.com/advisories/dockhand-open-redirect-via-oidc-initiation-endpoint","tags":[]}],"exploitRefs":[{"url":"https://github.com/Finsys/dockhand/releases/tag/v1.0.36","tags":[]}],"hasPoc":true,"ai":null}