CVE-2026-12071

Deferred Deferred - Pending Action

Open Redirect in TeamDavid Webbox

Publication date: 2026-08-07

Last updated on: 2026-09-07

Assigner: Switzerland Government Common Vulnerability Program

Description

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” (representing a dot), an attacker can manipulate the portion of the URL following the top-level domain (TLD). If a similar, registerable TLD exists (for example, if “.com” is the application’s domain, and “.company” is available for registration), an attacker can craft a URL to redirect users to a malicious “.company” domain. By using URL-encoded line feeds, it becomes possible to insert arbitrary response headers in the server's HTTP response. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-09-07

Generated

2026-09-17

AI Q&A

2026-08-07

EPSS Evaluated

2026-09-15

NVD

CVE-2026-12071

EUVD

EUVD-2026-54430

Affected Vendors & Products

Vendor	Product	Version / Range
tobit_laboratories_ag	webbox	524

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This vulnerability involves a web application called TeamDavid by Tobit Laboratories AG that improperly handles user-supplied input in redirect URLs. Attackers can manipulate the URL using URL-encoded characters like %2e (dot) to redirect users to malicious domains that mimic legitimate ones. For example, they could redirect from a .com domain to a .company domain if it exists. Additionally, URL-encoded line feeds allow inserting arbitrary HTTP response headers.

Detection Guidance

This vulnerability involves URL redirection manipulation and HTTP header injection via URL-encoded characters. To detect it, monitor HTTP responses for 302 redirects with unusual domains or encoded characters like %2e or line feeds (%0a). Inspect server logs for requests containing these patterns. Use tools like curl to test for open redirects by sending crafted URLs with encoded characters.

Impact Analysis

This vulnerability could allow attackers to trick users into visiting malicious websites by redirecting them from a trusted domain. Users might unknowingly enter credentials or download malware. Attackers could also manipulate HTTP headers to bypass security controls or perform phishing attacks.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face fines or penalties for failing to protect user data from such attacks.

Mitigation Strategies

Update TeamDavid to a version beyond Rollout 524 to address the URL redirection flaw. Validate all redirect URLs to ensure they do not contain URL-encoded characters or line feeds that could manipulate headers or domains.

Hi! I’m here to help you understand CVE-2026-12071. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70