Dockhand before version 1.0.36 contains an open redirect flaw in the OIDC initiation endpoint, allowing unauthenticated attackers to inject an unvalidated redirect parameter. The redirect can send authenticated users to attacker‑controlled sites. By targeting the OIDC callback flow, the attacker may capture authorization codes via the Referer header and then launch credential‑phishing attacks against any Dockhand account that has logged in for a valid session. The vulnerability is a classic redirect flaw as defined by CWE‑601.

All installations of Finsys Dockhand running a version older than 1.0.36 are affected. The issue resides in the OIDC initiation component and affects every instance where the redirect query parameter is provided to the endpoint without validation.

With a CVSS score of 5.3 the vulnerability is considered moderate. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, but remote exploitation is straightforward: an attacker can craft a malicious URL pointing to the OIDC initiation endpoint with an arbitrary redirect argument. Since no authentication is required to trigger the redirect, any user who clicks the link will be sent to a site the attacker controls. If the attacker captures an authorization code, the active session can be impersonated or phishing can be performed. The primary risk is unauthorized redirection and potential credential theft through Referer header leakage.