CVE-2026-53989

Name of the Vulnerable Software and Affected Versions Dockhand versions prior to 1.0.36

Description An open redirect exists in the OIDC initiation endpoint. Unauthenticated remote attackers can redirect authenticated users to external sites by injecting an unvalidated redirect query parameter. This allows attackers to craft malicious links targeting the OIDC callback flow to capture authorization codes through the Referer header, potentially leading to credential phishing against Dockhand accounts following a legitimate login.

Recommendations Update to version 1.0.36 or later.