EUVD-2026-37680Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Network-accessible with no attacker authentication, but mandatory victim interaction (UI:R); scope unchanged as the redirect is external; C:L and I:L reflect phishing-enabled credential and interface integrity risk without direct data extraction.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Lifecycle Timeline
1DescriptionCVE.org
Open redirection vulnerability in the authentication system allows an attacker to use manipulated values in the X-Forwarded-Host header to alter the URLs generated by the application. A successful exploit could redirect authenticated users to malicious sites following login procedures or interaction with the interface, resulting in limited impact on confidentiality and integrity.
AnalysisAI
Open redirection in the Password Manager authentication system enables network-accessible, unauthenticated attackers to manipulate the X-Forwarded-Host HTTP header to redirect authenticated users to attacker-controlled sites immediately following login or interface interaction. The vulnerability is particularly hazardous in the context of a credential store application, where a convincing post-login redirect to a cloned phishing interface could yield an attacker's full access to a victim's stored password vault. No public exploit code has been identified at time of analysis, and a vendor-released patch is available per the INCIBE advisory.
Technical ContextAI
This is a CWE-601 (URL Redirection to Untrusted Site / Open Redirect) vulnerability affecting the authentication subsystem of the Password Manager application (CPE: cpe:2.3:a:password_manager:password_manager:*:*:*:*:*:*:*:*). The root cause is the application's improper trust of the X-Forwarded-Host HTTP header when constructing post-authentication redirect URLs. X-Forwarded-Host is a proxy forwarding header intended to convey the original client-requested hostname through load balancers and reverse proxies; when an application uses this header without allowlist validation to build redirect destinations, any party that can influence request headers can point that destination at an arbitrary attacker-controlled domain. The password manager context amplifies the standard open redirect risk: users completing a login flow have an elevated expectation of being in a trusted environment, making them substantially more susceptible to credential re-entry on a convincingly cloned interface served at the spoofed redirect target.
RemediationAI
A vendor-released patch is confirmed available per the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-password-manager; administrators should consult this notice immediately to identify the exact fixed release version and apply the update. No specific patched version number was present in the provided intelligence, so the advisory must be consulted directly - the exact fix version is not independently confirmed from available data. As a compensating control prior to patch deployment, configure any upstream reverse proxy or WAF to strip or enforce an allowlist on the X-Forwarded-Host header before requests reach the application, accepting only the known legitimate application hostname; this prevents header injection but may require adjustment in multi-tenant or multi-domain deployments where X-Forwarded-Host carries legitimate values. Alternatively, network controls restricting who can submit requests with arbitrary headers (e.g., enforcing trusted proxy IP allowlists) reduce the attack surface. Users of the unpatched application should be alerted to verify the URL in their browser after any login redirect before entering credentials or sensitive data.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today