EUVD-2026-37680Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Network-accessible with no attacker authentication, but mandatory victim interaction (UI:R); scope unchanged as the redirect is external; C:L and I:L reflect phishing-enabled credential and interface integrity risk without direct data extraction.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Lifecycle Timeline
1DescriptionCVE.org
Open redirection vulnerability in the authentication system allows an attacker to use manipulated values in the X-Forwarded-Host header to alter the URLs generated by the application. A successful exploit could redirect authenticated users to malicious sites following login procedures or interaction with the interface, resulting in limited impact on confidentiality and integrity.
AnalysisAI
Open redirection in the Password Manager authentication system enables network-accessible, unauthenticated attackers to manipulate the X-Forwarded-Host HTTP header to redirect authenticated users to attacker-controlled sites immediately following login or interface interaction. The vulnerability is particularly hazardous in the context of a credential store application, where a convincing post-login redirect to a cloned phishing interface could yield an attacker's full access to a victim's stored password vault. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker control or influence the X-Forwarded-Host header value received by the Password Manager application - achievable by distributing a crafted URL through phishing, QR codes, or redirects, or by interposing an attacker-controlled proxy on the network path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 (Medium) reasonably reflects the constrained but meaningful real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker distributes a phishing email or message containing a crafted deep-link to the Password Manager login page with a manipulated X-Forwarded-Host header value pointing to an attacker-controlled domain that visually mimics the application. When the victim follows the link, authenticates successfully, and the application generates the post-login redirect using the untrusted header, they are transparently forwarded to the malicious site - still believing they are in a trusted session - where the attacker's interface captures a re-entered master password or session token. … |
| Remediation | A vendor-released patch is confirmed available per the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-password-manager; administrators should consult this notice immediately to identify the exact fixed release version and apply the update. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Host header injection in Nezha Monitoring versions 1.0.0 through 2.2.0 allows unauthenticated remote attackers to redire
Open redirect in the Aqara IAM/SSO Gateway (gw-builder.aqara.com) allows remote unauthenticated attackers to craft Aqara
Open redirection in Password Manager exposes users to phishing attacks by failing to validate the X-Forwarded-Host HTTP
Host Header Injection in Dell PowerFlex Rack RCM 3.7 enables unauthenticated remote attackers to trigger open redirects
DigestAuthMiddleware in aiohttp leaks HTTP Digest authentication credentials to attacker-controlled cross-origin redirec
Share
External POC / Exploit Code
Leaving vuln.today