Password Manager CVE-2026-10839

Exploitation requires that the attacker control or influence the X-Forwarded-Host header value received by the Password Manager application - achievable by distributing a crafted URL through phishing, QR codes, or redirects, or by interposing an attacker-controlled proxy on the network path. The victim must be an active user who follows the manipulated link and completes a login flow or interacts with the authenticated interface, satisfying the mandatory active user interaction (UI:A) condition; server-side exploitation without victim participation is not possible. No special server-side configuration is required - the vulnerability appears to exist in default deployments based on the wildcard CPE and description wording. Exploitation is strictly limited by the UI:A requirement, meaning automated mass exploitation is not feasible; the attack is phishing-dependent and requires targeted social engineering. The impact is bounded to low confidentiality and integrity (VC:L/VI:L); there is no authentication bypass, no remote code execution, and no availability impact, though the password manager product context makes even low-impact credential-adjacent redirection disproportionately dangerous.

The CVSS 4.0 score of 5.1 (Medium) reasonably reflects the constrained but meaningful real-world risk. The vector AV:N/AC:L/AT:N/PR:N/UI:A confirms network-accessible, low-complexity exploitation with no authentication required by the attacker, but critically mandates active user interaction - the victim must follow a crafted link and complete a login or interface action. This UI:A gate materially reduces mass-exploitation potential and aligns with phishing-dependent attack chains rather than autonomous scanning. The subsequent-system impacts (SC:L/SI:L) acknowledge that the redirect itself propagates limited harm beyond the vulnerable application boundary toward the user's trust context. KEV listing is absent from the provided intelligence, meaning active exploitation is not confirmed; no public exploit code has been identified at time of analysis, and no EPSS score was supplied, leaving probabilistic exploitation risk unquantified. Despite the medium score, the product category substantially elevates real-world consequence: a successful redirect against a password manager user that harvests a master password or session token could cascade into complete credential vault compromise - an impact the CVSS base score does not capture. Defenders should weight product sensitivity, not only CVSS, when prioritizing this patch.

An attacker distributes a phishing email or message containing a crafted deep-link to the Password Manager login page with a manipulated X-Forwarded-Host header value pointing to an attacker-controlled domain that visually mimics the application. When the victim follows the link, authenticates successfully, and the application generates the post-login redirect using the untrusted header, they are transparently forwarded to the malicious site - still believing they are in a trusted session - where the attacker's interface captures a re-entered master password or session token. No public exploit code exists for this specific CVE at time of analysis, though the technique is broadly documented and requires no specialized tooling beyond crafted HTTP headers.