TeamDavid Webbox CVE-2026-12071

The Webbox component of TeamDavid must be network-accessible and must expose a redirect endpoint that appends user-supplied input to a Location header value without sanitizing URL-encoded characters. The CVSS 4.0 vector confirms PR:N (no attacker authentication required) and UI:P (victim must interact with a crafted link). For the TLD-manipulation variant, the attacker must additionally control or register a domain whose TLD is a plausible extension of the application's domain (e.g., .company when the app uses .com) - this is an external prerequisite that limits opportunistic exploitation. For the header injection variant, no such external registration is needed. Exploitation is limited to TeamDavid deployments at Rollout 524 or earlier; deployments not exposing the Webbox component externally reduce but do not eliminate risk.

The CVSS 4.0 score of 5.3 (Medium) reflects AV:N/AC:L/AT:N/PR:N/UI:P - network-reachable, low complexity, no attack prerequisites, no privileges required, but dependent on a victim clicking a crafted link. The low-to-medium severity rating is appropriate for the open redirect component alone, but the HTTP header injection primitive deserves elevated attention: injected headers can set cookies (enabling session fixation), manipulate caching directives, or spoof security headers (e.g., X-Frame-Options), compounding phishing effectiveness beyond a simple redirect. No EPSS data was provided; given the absence of KEV listing and no identified public POC, real-world exploitation probability at time of analysis appears low but non-trivial given the simplicity of the attack. The infoguard.ch batch disclosure of 22 David CVEs increases the likelihood that a motivated researcher or attacker has working knowledge of the attack surface. The primary real-world risk is targeted phishing campaigns against TeamDavid users, not mass automated exploitation.

An attacker registers a lookalike domain (e.g., targetorg.company when the victim's TeamDavid instance runs on targetorg.com) and crafts a TeamDavid Webbox URL where the redirect parameter uses %2e-encoded characters to shift the resolved domain to the attacker's TLD. The attacker distributes this URL via email or messaging, and a victim familiar with the TeamDavid domain clicks the link, is transparently redirected to the attacker's phishing site, and submits credentials. In a more targeted variant, the attacker uses URL-encoded line feeds in the same parameter to inject a Set-Cookie header into the 302 response before the redirect fires, achieving session fixation without any redirect at all.