Vulnerability · Published Sep 29, 2026 · Assigned by VulnCheck

CVE-2026-53989Dockhand < 1.0.36 Open Redirect via OIDC Initiation Endpoint

Medium 4.7

In plain English

A medium-severity open redirect in dockhand from Finsys. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.3%top 82.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers to redirect authenticated users to attacker-controlled sites by injecting an unvalidated redirect query parameter. Attackers can craft a malicious link targeting the OIDC callback flow to capture authorization codes via the Referer header and conduct follow-up credential phishing against any Dockhand account after a legitimate login.

Affected products (as reported)

Vendor	Product	Versions
Finsys	dockhand	0 – before 1.0.36

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

References

Fixed Release Tag patch, release-notes
https://www.vulncheck.com/advisories/dockhand-open-redirect-via-oidc-initiation-endpoint third-party-advisory