EUVD-2026-37679Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Network-accessible, no auth required, but user must click a crafted link (UI:R); scope change (S:C) applies as the victim is redirected to an attacker-controlled system.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Lifecycle Timeline
1DescriptionCVE.org
Open redirection vulnerability due to insufficient validation of the X-Forwarded-Host HTTP header. An attacker could create manipulated links that, when opened by a victim, cause the victim to be redirected to domains controlled by the attacker, enabling phishing or deception attacks with limited impact on confidentiality and integrity.
AnalysisAI
Open redirection in Password Manager exposes users to phishing attacks by failing to validate the X-Forwarded-Host HTTP header before using it to construct redirect URLs. Unauthenticated remote attackers can craft malicious links that, when clicked by a victim, silently redirect them to an attacker-controlled domain - a particularly dangerous vector given that the target application manages credentials. Reported by INCIBE, a vendor patch is available; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Technical ContextAI
CWE-601 (URL Redirection to Untrusted Site) describes the root cause: the application reflects the HTTP X-Forwarded-Host header - intended for use by reverse proxies to preserve the originating Host value - into redirect responses without sufficient input validation. When an attacker forges this header in a request, the application constructs a redirect destination using the attacker-supplied value rather than the legitimate server hostname. The affected product is identified by CPE cpe:2.3:a:password_manager:password_manager:*:*:*:*:*:*:*:* across all recorded versions, indicating the flaw is not restricted to a specific release. The context of a password manager amplifies the phishing risk: victims redirected to a lookalike domain may be deceived into submitting master credentials or authentication tokens.
RemediationAI
Apply the vendor-released patch referenced in the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-password-manager. An exact patched version number is not independently confirmed from available data, so administrators should consult the advisory directly to identify the target upgrade version. As an immediate compensating control prior to patching, configure any upstream reverse proxy or load balancer to strip or enforce an allowlist on the X-Forwarded-Host header before requests reach the application, ensuring only the legitimate server hostname is passed through - this removes the attacker's ability to inject a forged value. Alternatively, a WAF rule rejecting requests whose X-Forwarded-Host value does not match a configured allowlist of trusted hostnames will block exploitation. Note that stripping this header entirely may break intended proxy-aware functionality if the application relies on it for correct host resolution; test in a staging environment before deploying broadly.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today