Password Manager EUVD-2026-37679

Exploitation requires the victim to click a crafted link (CVSS UI:A - active user interaction is mandatory and is the primary limiting factor). The application must process the X-Forwarded-Host HTTP header when generating redirect responses without enforcing a hostname allowlist; this is the specific vulnerable behavior. No authentication or account privileges are required of the attacker (PR:N). Exploitation is not limited to any specific deployment configuration - the vulnerability is in default header-processing behavior. What limits exploitation: the attacker cannot exploit this passively or via automated scanning; a social engineering step is required to deliver the crafted link to a victim. Additionally, the impact is indirect - the attacker gains no immediate access to the password manager's data; actual credential theft depends on the victim being deceived by the phishing page after redirection.

The CVSS 4.0 score of 5.1 (Medium) reflects a network-reachable, low-complexity, unauthenticated attack path (AV:N/AC:L/AT:N/PR:N) gated on user interaction (UI:A). The limited impact ratings (VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) are consistent with open redirect's indirect harm model: no direct data exfiltration or system compromise occurs through the vulnerability itself. However, CVSS scores for open redirect vulnerabilities routinely understate real-world risk when the target is a credential management application - a successful phishing redirect can yield master password theft with catastrophic downstream consequences. No EPSS score was provided in the source data, and neither CISA KEV listing nor public exploit code was identified, suggesting this has not yet attracted broad opportunistic exploitation. The actual priority should be elevated by defenders above raw CVSS for any password manager deployment exposed to end users via email or web links.

An attacker composes a phishing email or message containing a legitimate-looking link to the target Password Manager instance, but with a forged X-Forwarded-Host header value embedded or triggered via a crafted intermediary request pointing to an attacker-controlled domain. When the victim clicks the link and the application processes the forged header to construct a redirect, the victim is silently sent to a convincing replica of the password manager login page hosted by the attacker, where they may enter their master password or MFA token. No public exploit code is known at time of analysis, but the technique is well-understood and trivially implemented given the open redirect class.