CVE-2026-94214
Deferred Deferred - Pending Action

Open Redirect in ST Engineering iDirect Evolution WebServer

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulDB

Description
A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This affects an unknown part of the file /login.html of the component Management Service. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94214
EUVD
EUVD-2026-83902

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
st_engineering idirect_evolution *
st_engineering velocity_webserver_evolution to 20260717 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-94214 is a pre-authentication Host header injection and open redirect flaw in ST Engineering iDirect Evolution and Velocity WebServer Evolution. When accessing unprotected resources via HTTP, the server constructs an HTTPS login redirect URL using the Host header from the request, appending it as Location: https://<Host>:443/login.html. Since the Host header is not validated, attackers can manipulate it to redirect users to malicious domains.

Detection Guidance

To detect CVE-2026-94214, send a crafted HTTP request with a manipulated Host header to the iDirect WebServer. Use curl with a command like: curl -v -H 'Host: attacker.com' http://<target-ip>/login.html. If the server responds with a redirect to https://attacker.com:443/login.html, the vulnerability is present.

Impact Analysis

This vulnerability allows attackers to redirect users to malicious domains, enabling phishing attacks, bypassing trusted management domains, and causing redirect pollution in reverse proxy scenarios. The attack requires no authentication and can be exploited by sending a crafted HTTP request with a manipulated Host header.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling phishing attacks and unauthorized redirects. If exploited, it may lead to unauthorized access to sensitive data or systems, violating confidentiality requirements under these regulations. However, the primary impact is on system integrity and availability rather than direct compliance violations.

Mitigation Strategies

Do not rely on the Host header for URL construction. Use a fixed management domain or IP for redirects. If the Host header must be used, validate it against a strict whitelist and filter control characters and illegal ports. Return relative redirect paths like /login.html instead of absolute URLs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94214. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart