The vulnerability resides in the /authorize component of the HTTP Request Handler for ST Engineering iDirect Evolution and Velocity WebServer Evolution. By manipulating the query string parameter named Success, an attacker can induce HTTP response splitting, allowing insertion of arbitrary HTTP headers or payloads into the server’s response. This flaw can enable attacks that manipulate client expectations or redirect to malicious sites if the split response is leveraged.

Entities running ST Engineering iDirect Evolution or Velocity WebServer Evolution software are impacted. The vulnerability identification references the component path /authorize, but no specific product versions are listed in the official data; the flaw has been confirmed on at least one EOL variant (X7 or legacy Evolution 21.x) and no validated impact has been reported for newer supported releases.

The advisory rates the vulnerability with a CVSS score of 5.3, placing it in the medium severity range. An EPSS score of less than 1% indicates that the probability of exploitation is low, and the weakness is not cataloged in CISA's KEV database. Attackers can execute the exploit remotely by crafting requests that alter the Success parameter, yet no vendor patch or fix has yet been disclosed, meaning the risk persists until an update is applied or mitigated through other controls.