Finsys Dockhand vulnerabilities

CVE-2026-53988 [CRITICAL] CWE-306 CVE-2026-53988: Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send unsigned webhook requests to force git clone and docker c

CVE-2026-53989 [MEDIUM] CWE-601 CVE-2026-53989: Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers to redirect authenticated users to attacker-controlled sites by injecting an unvalidated redirect query parameter. Attackers can craft a malicious link targeting the OIDC callback flow to capture authorization co