EUVD-2026-54446
GHSA-wcq4-5c3j-fpmj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no privileges required, but user must click crafted URL (UI:R); scope changes as the redirect carries the victim outside the application boundary.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
1DescriptionCVE.org
Tobit Laboratories AG TeamDavid's Webbox contains an open redirect vulnerability via the “replyUrl” parameter. An attacker can exploit this vulnerability to craft a URL within the application that, when visited, redirects the user’s browser to an arbitrary third-party site. This can be abused for phishing attacks, where users receive a trusted domain link but are redirected to a phishing website. This issue affects TeamDavid through Rollout 524.
AnalysisAI
Open redirect in the Webbox component of TeamDavid (Tobit Laboratories AG's Microsoft 365 alternative) enables unauthenticated network attackers to craft URLs on the trusted TeamDavid domain that silently redirect visiting users to arbitrary external sites by supplying an unsanitized value in the 'replyUrl' parameter. All versions through Rollout 524 are affected per the CPE listing. This issue was disclosed as part of a coordinated report of 22 CVEs in the David platform by InfoGuard and reported to NCSC.ch; no confirmed active exploitation or public exploit code has been identified at time of analysis.
Technical ContextAI
The vulnerability resides in TeamDavid's Webbox component (CPE: cpe:2.3:a:tobit_laboratories_ag:teamdavid:*:*:*:*:*:*:*:*). CWE-601 (URL Redirection to Untrusted Site / Open Redirect) describes the root cause: the application accepts user-controlled input in the 'replyUrl' parameter and uses it directly as a redirect destination without validating it against an allowlist of permitted domains. This is a server-side failure to sanitize redirect targets - a class of flaw typically introduced when login or callback flows accept a return-URL parameter without domain-restriction logic. Because TeamDavid markets itself as a secure M365 alternative for enterprise and SME environments, the trusted reputation of its domain is particularly valuable as a phishing launchpad, amplifying the social-engineering potential beyond what a bare CVSS score reflects.
RemediationAI
Upgrade TeamDavid to a rollout version beyond Rollout 524 by consulting the vendor release notes at https://david.tobit.software/releasenotes to confirm the exact patched build. The vendor fix should implement server-side validation of the 'replyUrl' parameter against an explicit allowlist of permitted redirect hostnames, rejecting or nullifying values pointing to external domains. As a compensating control prior to patching, administrators may deploy a WAF rule to intercept and block requests where 'replyUrl' contains an external scheme or host - however, aggressive blocking may interrupt legitimate reply-flow functionality within the application, so test thoroughly before deploying in production. Additionally, consider the broader InfoGuard advisory at https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ for guidance on the full set of 22 disclosed issues, which may require a more comprehensive remediation review of the platform.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today