CVE-2026-94214

Deferred Deferred - Pending Action

Open Redirect in ST Engineering iDirect Evolution WebServer

Publication date: 2026-09-21

Last updated on: 2026-10-14

Assigner: VulDB

Description

A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-09-21

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94214

EUVD

EUVD-2026-83902

Affected Vendors & Products

Vendor	Product	Version / Range
st_engineering	idirect_evolution	*
st_engineering	velocity_webserver_evolution	to 20260717 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

CVE-2026-94214 is a pre-authentication Host header injection and open redirect flaw in ST Engineering iDirect Evolution and Velocity WebServer Evolution. When accessing unprotected resources via HTTP, the server constructs an HTTPS login redirect URL using the Host header from the request, appending it as Location: https://<Host>:443/login.html. Since the Host header is not validated, attackers can manipulate it to redirect users to malicious domains.

Detection Guidance

To detect CVE-2026-94214, send a crafted HTTP request with a manipulated Host header to the iDirect WebServer. Use curl with a command like: curl -v -H 'Host: attacker.com' http://<target-ip>/login.html. If the server responds with a redirect to https://attacker.com:443/login.html, the vulnerability is present.

Impact Analysis

This vulnerability allows attackers to redirect users to malicious domains, enabling phishing attacks, bypassing trusted management domains, and causing redirect pollution in reverse proxy scenarios. The attack requires no authentication and can be exploited by sending a crafted HTTP request with a manipulated Host header.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling phishing attacks and unauthorized redirects. If exploited, it may lead to unauthorized access to sensitive data or systems, violating confidentiality requirements under these regulations. However, the primary impact is on system integrity and availability rather than direct compliance violations.

Mitigation Strategies

Do not rely on the Host header for URL construction. Use a fixed management domain or IP for redirects. If the Host header must be used, validate it against a strict whitelist and filter control characters and illegal ports. Return relative redirect paths like /login.html instead of absolute URLs.

Hi! I’m here to help you understand CVE-2026-94214. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70