Dockhand CVE-2026-53989

Exploitation targets the OIDC initiation/callback flow specifically: the affected Dockhand deployment must use OIDC/SSO authentication, and the initiation endpoint must accept an attacker-supplied, unvalidated redirect query parameter (the core flaw). The attack is unauthenticated to launch (PR:N) but requires victim user interaction (UI:P) - a legitimate Dockhand user must click the crafted link AND complete a real login for the authorization code to leak via the Referer header. It also implicitly depends on the browser/deployment forwarding the Referer to the attacker-controlled destination. Primary limiters: OIDC must be the configured auth mechanism, the target must be running a version before 1.0.36, and social engineering must succeed; there is no direct impact on the Dockhand host itself.

This is a genuinely low-to-moderate priority issue, and the signals are internally consistent rather than conflicting. The vendor CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P) reflects an unauthenticated, network-reachable open redirect (CWE-601) whose only impact is subsequent-system confidentiality (SC:L) - there is no confidentiality, integrity, or availability impact on the Dockhand instance itself (VC:N/VI:N/VA:N). The defining limiter is UI:P: exploitation requires a victim to click an attacker-crafted link and complete a legitimate OIDC login, so this is a phishing/token-leak enabler, not a direct compromise. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' A patch is confirmed available (v1.0.36). Net: a real, credible bug worth patching in login flows, but not an emergency - its blast radius depends entirely on successful social engineering, and open redirects are rarely mass-exploited on their own. No key signals conflict here; the low real-world urgency is driven by the required user interaction and the absence of direct system impact.

An attacker crafts a malicious link to Dockhand's OIDC initiation endpoint with an unvalidated redirect query parameter pointing to an attacker-controlled site, then delivers it via email or chat. When a victim clicks and completes a legitimate login, the OIDC authorization code can leak to the attacker's site through the Referer header, and the victim can be bounced to a convincing credential-phishing page for their Dockhand account. No public proof-of-concept is identified in the provided data, and success depends on the victim following the link and authenticating (UI:P).