CVE-2025-50578 Open redirect in n/a
An attacker can manipulate HTTP headers to redirect users to malicious sites, enabling phishing and session theft in the Heimdall application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-50578?
CVE-2025-50578 is a critical vulnerability in n/a, published on 30 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` and `Referer`. An unauthenticated remote attacker can manipulate these headers to perform Host Header Injection and Open Redirect attacks. This allows the loading of external resources from attacker-controlled domains and unintended redirection of users, potentially enabling phishing, UI redress, and session theft. The vulnerability exists due to insufficient validation and trust of untrusted input, affecting the integrity and trustworthiness of the application.
Which versions are affected by CVE-2025-50578?
It affects 1 product.
Products include Linuxserver Docker-Heimdall.
How do I fix CVE-2025-50578?
No fix has been published for CVE-2025-50578 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-50578 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-50578 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-2c6m-gpf4-cfgp.