CVE-2026-85676

Name of the Vulnerable Software and Affected Versions Dub (affected versions not specified)

Description An open redirect issue exists where the redir url query parameter is accepted on every short link without validation or domain allowlist enforcement. This allows attackers to append the redir url parameter to any short link to redirect visitors to arbitrary external URLs via the trusted Dub domain. This behavior can bypass destination blacklists and facilitate phishing attacks through link cloaking, which is a technique used to hide the true destination of a link.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.