EUVD-2026-37679Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Network-accessible, no auth required, but user must click a crafted link (UI:R); scope change (S:C) applies as the victim is redirected to an attacker-controlled system.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Lifecycle Timeline
1DescriptionCVE.org
Open redirection vulnerability due to insufficient validation of the X-Forwarded-Host HTTP header. An attacker could create manipulated links that, when opened by a victim, cause the victim to be redirected to domains controlled by the attacker, enabling phishing or deception attacks with limited impact on confidentiality and integrity.
AnalysisAI
Open redirection in Password Manager exposes users to phishing attacks by failing to validate the X-Forwarded-Host HTTP header before using it to construct redirect URLs. Unauthenticated remote attackers can craft malicious links that, when clicked by a victim, silently redirect them to an attacker-controlled domain - a particularly dangerous vector given that the target application manages credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to click a crafted link (CVSS UI:A - active user interaction is mandatory and is the primary limiting factor). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 (Medium) reflects a network-reachable, low-complexity, unauthenticated attack path (AV:N/AC:L/AT:N/PR:N) gated on user interaction (UI:A). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker composes a phishing email or message containing a legitimate-looking link to the target Password Manager instance, but with a forged X-Forwarded-Host header value embedded or triggered via a crafted intermediary request pointing to an attacker-controlled domain. When the victim clicks the link and the application processes the forged header to construct a redirect, the victim is silently sent to a convincing replica of the password manager login page hosted by the attacker, where they may enter their master password or MFA token. … |
| Remediation | Apply the vendor-released patch referenced in the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-password-manager. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Host header injection in Nezha Monitoring versions 1.0.0 through 2.2.0 allows unauthenticated remote attackers to redire
Open redirect in the Aqara IAM/SSO Gateway (gw-builder.aqara.com) allows remote unauthenticated attackers to craft Aqara
Open redirection in the Password Manager authentication system enables network-accessible, unauthenticated attackers to
Host Header Injection in Dell PowerFlex Rack RCM 3.7 enables unauthenticated remote attackers to trigger open redirects
DigestAuthMiddleware in aiohttp leaks HTTP Digest authentication credentials to attacker-controlled cross-origin redirec
Share
External POC / Exploit Code
Leaving vuln.today