CVE-2026-12071
TeamDavid: Header Injection leading to Open Redirect via URL-encoded characters
Description
The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” (representing a dot), an attacker can manipulate the portion of the URL following the top-level domain (TLD). If a similar, registerable TLD exists (for example, if “.com” is the application’s domain, and “.company” is available for registration), an attacker can craft a URL to redirect users to a malicious “.company” domain. By using URL-encoded line feeds, it becomes possible to insert arbitrary response headers in the server's HTTP response. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
INFO
Published Date :
Aug. 7, 2026, 10:16 a.m.
Last Modified :
Oct. 23, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-12071
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | MEDIUM | 455daabc-a392-441d-aa46-37d35189897c | ||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Sanitize user-supplied input for redirect URLs.
- Validate redirect targets against a whitelist.
- Update TeamDavid to Rollout 524 or later.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-12071.
| URL | Resource |
|---|---|
| https://chayns.net/77892-10814/tapp/763210?postId=11454 | |
| https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-12071 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-12071
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-12071 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-12071 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: TeamDavid de Tobit Laboratories AG, Description: El Webbox de TeamDavid de Tobit Laboratories AG construye URLs de redirección utilizando entrada proporcionada por el usuario, que se añade al objetivo de redirección en una respuesta HTTP 302. Al utilizar caracteres codificados en URL como ’%2e’ (que representa un punto), un atacante puede manipular la porción de la URL que sigue al dominio de nivel superior (TLD). Si existe un TLD similar y registrable (por ejemplo, si ’.com’ es el dominio de la aplicación y ’.company’ está disponible para registro), un atacante puede elaborar una URL para redirigir a los usuarios a un dominio ’.company’ malicioso. Al utilizar saltos de línea codificados en URL, se hace posible insertar encabezados de respuesta arbitrarios en la respuesta HTTP del servidor. Este problema afecta a TeamDavid hasta el Rollout 524. -
CVE Modified by [email protected]
Sep. 07, 2026
Action Type Old Value New Value Changed Description The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” (representing a dot), an attacker can manipulate the portion of the URL following the top-level domain (TLD). If a similar, registerable TLD exists (for example, if “.com” is the application’s domain, and “.company” is available for registration), an attacker can craft a URL to redirect users to a malicious “.company” domain. By using URL-encoded line feeds, it becomes possible to insert arbitrary response headers in the server's HTTP response. This issue affects TeamDavid through Rollout 524. The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” (representing a dot), an attacker can manipulate the portion of the URL following the top-level domain (TLD). If a similar, registerable TLD exists (for example, if “.com” is the application’s domain, and “.company” is available for registration), an attacker can craft a URL to redirect users to a malicious “.company” domain. By using URL-encoded line feeds, it becomes possible to insert arbitrary response headers in the server's HTTP response. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality. Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/12xxx/CVE-2026-12071.json">CVE-2026-12071</a> Added Reference https://chayns.net/77892-10814/tapp/763210?postId=11454 Added Reference https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ Removed Reference https://david.tobit.software/releasenotes Removed Reference https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 10, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-12071', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-10T11:19:50.374307Z'} -
New CVE Received by [email protected]
Aug. 07, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Tobit Laboratories AG', 'modules': ['Webbox'], 'product': 'TeamDavid', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'custom', 'lessThanOrEqual': 'Rollout 524'}], 'defaultStatus': 'unaffected'}] Added Description The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” (representing a dot), an attacker can manipulate the portion of the URL following the top-level domain (TLD). If a similar, registerable TLD exists (for example, if “.com” is the application’s domain, and “.company” is available for registration), an attacker can craft a URL to redirect users to a malicious “.company” domain. By using URL-encoded line feeds, it becomes possible to insert arbitrary response headers in the server's HTTP response. This issue affects TeamDavid through Rollout 524. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-601 Added Reference https://david.tobit.software/releasenotes Added Reference https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/