The Webbox component of TeamDavid builds HTTP 302 responses that incorporate user‑supplied query strings into the redirect target. By sending URL‑encoded dot characters ("%2e") or line‑feed sequences, an attacker can alter the portion of the URL that follows the top‑level domain and cause the application to redirect to a different domain that may be registered by the attacker, such as changing a ".com" to a malicious ".company". Additionally, injected line feeds allow arbitrary header fields to be inserted into the server’s response, enabling further exploitation such as phishing or session hijacking. This vulnerability is classified as CWE-601 (Open Redirect) and involves improper validation of redirect destinations and lack of filtering for CRLF injection.

The affected product is TeamDavid, a secure Microsoft 365 alternative developed by Tobit Laboratories AG. The issue is present in Rollout 524 and any earlier release up to that point. No other vendors are listed.

The CVSS score of 5.3 indicates a moderate‑severity flaw. Exploit probability is unknown as no EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is web‑based; a malicious craft URL can be distributed to users via phishing or legitimate links. The attacker only needs the ability to send a specially crafted URL to the target; no authentication or privileged access is required. Because the vulnerable code leaves the redirect target unsanitized, the exploitation is straightforward and does not require complex conditions.