The Webbox component of TeamDavid incorporates user‑supplied query strings into 302 HTTP redirect responses. By sending URL‑encoded characters such as "%2e" to represent a dot, an attacker can alter the part of the URL after the top‑level domain and point the redirect to a different, potentially malicious domain that an attacker can register. Additionally, the vulnerable code allows URL‑encoded line‑feed sequences, which can produce CRLF injection that inserts arbitrary response headers into the HTTP output. These behaviors enable an attacker to perform open redirects and inject headers, potentially facilitating phishing or session hijacking.

The affected product is TeamDavid, a Webbox-based application developed by Tobit Laboratories AG. The vulnerability exists in all releases prior to Rollout 528. Beginning with Rollout 528 (released on June 30 2026), the redirect functionality is disabled by default, so the flaw is no longer exposed in those newer releases. No other vendors or products are listed as impacted.

The CVSS score of 5.3 indicates a moderate severity flaw. The EPSS score is below 1 %, implying a low probability that the vulnerability will be exploited in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by constructing a specially crafted URL; no authentication or privileged access is required. Because the vulnerable code fails to validate redirect targets or filter CRLF characters, the exploitation path is straightforward and does not require complex prerequisites.