which is appended to the redirect target in a 302 HTTP response. By
using URL-encoded characters such as “%2e” (representing a dot), an
attacker can manipulate the portion of the URL following the top-level
domain (TLD). If a similar, registerable TLD exists (for example, if
“.com” is the application’s domain, and “.company” is available for
registration), an attacker can craft a URL to redirect users to a
malicious “.company” domain. By using URL-encoded line feeds, it becomes
possible to insert arbitrary response headers in the server's HTTP
response.
This issue affects TeamDavid through Rollout 524.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Tobit Laboratories AG | TeamDavid | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 07 Aug 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” (representing a dot), an attacker can manipulate the portion of the URL following the top-level domain (TLD). If a similar, registerable TLD exists (for example, if “.com” is the application’s domain, and “.company” is available for registration), an attacker can craft a URL to redirect users to a malicious “.company” domain. By using URL-encoded line feeds, it becomes possible to insert arbitrary response headers in the server's HTTP response. This issue affects TeamDavid through Rollout 524. | |
| Title | TeamDavid: Header Injection leading to Open Redirect via URL-encoded characters | |
| Weaknesses | CWE-601 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: NCSC.ch
Published:
Updated: 2026-08-07T09:40:52.596Z
Reserved: 2026-06-12T09:32:52.061Z
Link: CVE-2026-12071
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-07T11:30:03Z
-
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')