CVE-2026-85676: URL Redirection to Untrusted Site ('Open Redirect') in dubinc dub

The vulnerability in dubinc dub involves an open redirect via the redir_url query parameter on short links. Because there is no validation or domain allowlist enforcement on this parameter, attackers can append arbitrary URLs to redirect users through the Dub domain. This can be abused to bypass blacklists and enable phishing attacks by making malicious links appear to originate from a trusted domain. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on confidentiality and integrity.

An attacker can exploit this vulnerability to redirect users to arbitrary external websites through the trusted Dub domain. This can be used to bypass destination blacklists and facilitate phishing attacks by cloaking malicious URLs, potentially deceiving users into trusting harmful sites. There is no indication of direct compromise of the Dub service or user data from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious of links using the redir_url parameter in dubinc dub short links. Consider implementing additional URL filtering or user education to mitigate phishing risks.