Which versions of LiteSpeed Web Server are affected by CVE-2026-93903?

LiteSpeed Web Server, a widely deployed web server product, is affected by a critical vulnerability (CVE-2026-93903) that allows an authenticated low-privileged attacker to bypass internal URL…. A patch is available.

How to fix or mitigate CVE-2026-93903?

Within 24 hours, inventory all LiteSpeed Web Server instances to identify any running versions before 6.3.7 build 1, and immediately restrict administrative and internal network access to these servers to trusted IP ranges; enable detailed logging and monitor for double-encoded URL patterns indicative of CWE-174 attempts. Within 7 days, if a vendor patch becomes available, upgrade to LiteSpeed Web Server 6.3.7 build 1 or later; if not, implement compensating controls such as enforcing multi-factor authentication for all users, applying least-privilege principles to limit low-privileged accounts, and deploying a web application firewall with custom rules to detect and block double-decoding anomalies. Within 30 days, review and harden URL normalization and validation logic in custom integrations, conduct a thorough audit of server access logs for signs of exploitation, and establish a process to monitor LiteSpeed vendor advisories for the release of a fixed version (6.3.7 build 1 or later) to ensure timely patching across all affected systems.

LiteSpeed Web Server CVE-2026-93903

Q: What is the CVSS score of CVE-2026-93903?

CVE-2026-93903 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-89955 CRITICAL

Double Decoding of the Same Data (CWE-174)

2026-09-30 mitre

GHSA-8x5w-4247-99g6

Information Disclosure Litespeed Web Server Litespeedtech

9.4

CVSS 4.0 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

The 'corner case' qualifier implies AC:H; PR:L per vendor; internal-redirect bypass crosses a security boundary (S:C) and is confidentiality-primary (Information Disclosure tag), with limited/no integrity-availability support in the description.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Sep 30, 2026 - 15:17 EUVD

Analysis Generated

Sep 30, 2026 - 14:16 vuln.today

CVE Published

Sep 30, 2026 - 13:44 cve.org

CRITICAL 9.4

DescriptionCVE.org

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."

AnalysisAI

Internal redirection URL validation in LiteSpeed Web Server before 6.3.7 build 1 can be bypassed in a narrow 'corner case', allowing an authenticated remote user with low privileges (PR:L per the vendor vector) to have a crafted URL resolve to a resource other than the one the validation logic approved. Because the flaw stems from the URL normalization path decoding the same value more than once (CWE-174), the malformed request passes the check in its first-decoded form but takes on different meaning after a second decode; the assessed impact is high confidentiality loss with only limited integrity impact and no availability loss, with scope crossing into the underlying system. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires reaching LiteSpeed's internal-redirect URL-validation path and triggering a specific 'corner case' (per the description) - i.e., a precisely crafted URL that the normalization/double-decode logic (CWE-174) mishandles; this is not a broad, always-on condition. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N with all vulnerable- AND subsequent-system impacts High, score 9.4) portrays this as a near-critical, low-complexity, low-privilege network flaw with scope-crossing consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to LiteSpeed Web Server 6.3.7 build 1 or later, which is the vendor-released fix identified in the LiteSpeed release log (https://www.litespeedtech.com/products/litespeed-web-server/release-log) and the changelog (https://docs.litespeedtech.com/lsws/changelog/#v6-3-7-build-1); no workaround is documented in the available references, and because the defect is in URL normalization rather than a configurable feature, disabling internal redirects outright is the only structural mitigation and would break legitimate rewrite/internal-redirect behavior, so it is practical only on hosts that do not rely on them. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all LiteSpeed Web Server instances to identify any running versions before 6.3.7 build 1, and immediately restrict administrative and internal network access to these servers to trusted IP ranges; enable detailed logging and monitor for double-encoded URL patterns indicative of CWE-174 attempts. …

Threat intelligence, references, and detailed analysis are available after sign-in.