CVE-2026-53989 describes an open redirect vulnerability in Finsys Dockhand prior to version 1.0.36. The issue exists in the OIDC initiation endpoint where an unvalidated redirect query parameter allows unauthenticated remote attackers to redirect authenticated users to malicious sites. Attackers can exploit this by crafting malicious links targeting the OIDC callback flow, potentially capturing authorization codes through the Referer header and conducting subsequent credential phishing against Dockhand accounts.

Successful exploitation can redirect authenticated users to attacker-controlled websites, potentially exposing authorization codes via the Referer header. This exposure can facilitate credential phishing attacks post-login, compromising user accounts. The vulnerability does not require privileges or authentication to exploit but does require user interaction (clicking a crafted link).

A fix is available in Dockhand version 1.0.36. Users and administrators should upgrade to version 1.0.36 or later to remediate this vulnerability. Until patched, avoid clicking suspicious links related to Dockhand's OIDC login flow.