CVE-2026-85676 Details

A open redirect vulnerability has been identified in Dub, an open-source link attribution platform. This issue arises from the redir_url query parameter, which is accepted on all short links without proper validation or domain allowlist enforcement. As a result, attackers can append the redir_url parameter to any short link, redirecting visitors to arbitrary external URLs through the trusted Dub domain. This bypasses destination blacklists and could facilitate phishing attacks, especially with link cloaking enabled.

To address this vulnerability, it is recommended to remove the redir_url parameter if it is not necessary for public use, or to restrict it to a workspace-configured allowlist of approved domains. If the parameter is needed for internal purposes, such as Stripe redirects, it should be validated against the link's workspace domains or a signed token to prevent external abuse.