CVE-2026-12071
Received Received - Intake

Open Redirect in TeamDavid Webbox

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: Switzerland Government Common Vulnerability Program

Description
The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” (representing a dot), an attacker can manipulate the portion of the URL following the top-level domain (TLD). If a similar, registerable TLD exists (for example, if “.com” is the application’s domain, and “.company” is available for registration), an attacker can craft a URL to redirect users to a malicious “.company” domain. By using URL-encoded line feeds, it becomes possible to insert arbitrary response headers in the server's HTTP response. This issue affects TeamDavid through Rollout 524.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-12071
EUVD
EUVD-2026-54430

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tobit_laboratories_ag webbox 524

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a web application called TeamDavid by Tobit Laboratories AG that improperly handles user-supplied input in redirect URLs. Attackers can manipulate the URL using URL-encoded characters like %2e (dot) to redirect users to malicious domains that mimic legitimate ones. For example, they could redirect from a .com domain to a .company domain if it exists. Additionally, URL-encoded line feeds allow inserting arbitrary HTTP response headers.

Detection Guidance

This vulnerability involves URL redirection manipulation and HTTP header injection via URL-encoded characters. To detect it, monitor HTTP responses for 302 redirects with unusual domains or encoded characters like %2e or line feeds (%0a). Inspect server logs for requests containing these patterns. Use tools like curl to test for open redirects by sending crafted URLs with encoded characters.

Impact Analysis

This vulnerability could allow attackers to trick users into visiting malicious websites by redirecting them from a trusted domain. Users might unknowingly enter credentials or download malware. Attackers could also manipulate HTTP headers to bypass security controls or perform phishing attacks.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face fines or penalties for failing to protect user data from such attacks.

Mitigation Strategies

Update TeamDavid to a version beyond Rollout 524 to address the URL redirection flaw. Validate all redirect URLs to ensure they do not contain URL-encoded characters or line feeds that could manipulate headers or domains.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12071. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart