Clawhost
Monthly
Open redirect in antoinersx clawhost through version 0.0.45 allows remote attackers to craft reverse-proxy URLs that send victims to attacker-controlled sites by manipulating the token argument handled in reverseProxy.ts. Exploitation requires user interaction - a victim must follow the crafted link - and impact is limited to integrity (phishing/credential-harvesting), consistent with CVSS 5.3 v4.0 and an assessed CVSS 3.1 score of 4.3. Publicly available exploit code exists, but there is no confirmed active exploitation (not CISA KEV).
Open redirect in antoinersx clawhost through version 0.0.45 allows remote attackers to craft reverse-proxy URLs that send victims to attacker-controlled sites by manipulating the token argument handled in reverseProxy.ts. Exploitation requires user interaction - a victim must follow the crafted link - and impact is limited to integrity (phishing/credential-harvesting), consistent with CVSS 5.3 v4.0 and an assessed CVSS 3.1 score of 4.3. Publicly available exploit code exists, but there is no confirmed active exploitation (not CISA KEV).