CVE-2026-93903
Received Received - Intake

LiteSpeed Web Server URL Validation Bypass

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: MITRE

Description
LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-93903
EUVD
EUVD-2026-89955

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
litespeed_technologies litespeed_web_server to 6.3.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-174 The product decodes the same input twice, which can limit the effectiveness of any protection mechanism that occurs in between the decoding operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LiteSpeed Web Server (LSWS) before version 6.3.7 build 1 has a vulnerability where internal redirect URL validation fails in a specific corner case. This could allow unauthorized access or manipulation of server behavior through crafted URLs.

Impact Analysis

This vulnerability could allow attackers to bypass security controls, gain unauthorized access to restricted resources, or manipulate server responses. It may lead to data breaches, defacement, or service disruption if exploited.

Mitigation Strategies

Upgrade LiteSpeed Web Server to version 6.3.7 build 1 or later to address the internal redirect URL validation issue. Review and apply security updates from the LiteSpeed release logs and changelogs for versions 6.4.0 RC2 and 6.3.7.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93903. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart