CVE-2026-53989

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53989
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53989.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53989
Published
2026-09-29T19:42:43Z
Modified
2026-10-02T03:30:22Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N CVSS Calculator
Summary
Dockhand < 1.0.36 Open Redirect via OIDC Initiation Endpoint
Details

Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers to redirect authenticated users to attacker-controlled sites by injecting an unvalidated redirect query parameter. Attackers can craft a malicious link targeting the OIDC callback flow to capture authorization codes via the Referer header and conduct follow-up credential phishing against any Dockhand account after a legitimate login.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-601"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53989.json"
}
References

Affected packages

Git / github.com/finsys/dockhand

Affected ranges

Type
GIT
Repo
https://github.com/finsys/dockhand
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
685132ff893685e3052282a39b542f44483e900a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.0.36"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.26
v1.0.27
v1.0.28
v1.0.29
v1.0.30
v1.0.31
v1.0.32
v1.0.33
v1.0.34
v1.0.35

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53989.json"