What is the CVSS score of CVE-2026-10836?

CVE-2026-10836 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-10836?

Yes, a patch is available for CVE-2026-10836. Update the affected software to the latest version immediately.

Password Manager CVE-2026-10836

EUVD-2026-37678 MEDIUM

Improper Neutralization of HTTP Headers for Scripting Syntax (CWE-644)

2026-06-17 INCIBE

Information Disclosure Password Manager

5.1

CVSS 4.0 · Vendor: INCIBE

Severity by source

Vendor (INCIBE) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

vuln.today AI

6.1 MEDIUM

Network-reachable with no auth required, but scope changes to dependent services and user must interact with reflected content.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (INCIBE).

CVSS VectorVendor: INCIBE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 13:16 vuln.today

DescriptionCVE.org

Improper handling of HTTP headers that allows a remote attacker to manipulate the value of the Host header using specially crafted requests. A successful exploit could result in the generation of manipulated links or responses, potentially leading to limited information disclosure or compromising the integrity of dependent services.

AnalysisAI

Host Header Injection in Password Manager (all versions per CPE) enables remote unauthenticated attackers to manipulate the HTTP Host header, causing the application to generate crafted links or responses that reference an attacker-controlled domain. Exploitation requires active user interaction (UI:A per CVSS 4.0 vector), limiting mass exploitation but enabling targeted phishing, password-reset link hijacking, or cache poisoning affecting dependent services. No public exploit code has been identified, and INCIBE has confirmed a vendor patch is available. This vulnerability is part of a broader set of issues disclosed simultaneously in the same INCIBE advisory.

Technical ContextAI

CWE-644 (Improper Neutralization of HTTP Headers for Scripting Syntax) describes the root cause: the application accepts and reflects the HTTP Host header value without adequate validation or sanitization. Web applications that use the Host header to dynamically construct internal URLs - such as password-reset links, redirect targets, or API endpoints - are particularly susceptible because the generated content inherits the attacker-supplied hostname. In a password manager context, this is especially sensitive given that generated links may point to credential reset flows. The CPE string cpe:2.3:a:password_manager:password_manager:*:*:*:*:*:*:*:* uses a wildcard version field, indicating the flaw spans all known versions of this product. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms the attack surface is network-reachable with no special prerequisites beyond a user interacting with attacker-influenced content.

RemediationAI

A vendor-released patch is confirmed available per the INCIBE advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-password-manager); however, the exact patched version number is not specified in the available data - consult the advisory directly to identify the target upgrade version. As an immediate compensating control pending upgrade, deployers should configure a reverse proxy or WAF rule to enforce a strict allowlist of permitted Host header values, rejecting or rewriting requests where the Host header does not match the application's canonical hostname - this eliminates the injection vector without application changes. Additionally, disabling any application features that embed the Host header value into outbound links (e.g., password-reset email generation) until patching is complete removes the highest-impact exploitation path. Note that Host header allowlisting at the proxy layer may break multi-tenant or virtual-host deployments and should be tested before production rollout.