CVE-2026-10839 Open redirection vulnerability in Password Manager
Attackers can redirect authenticated users to malicious sites via manipulated X-Forwarded-Host headers in the Password Manager authentication system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-10839?
CVE-2026-10839 is a medium-severity vulnerability in Password Manager, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Open redirection vulnerability in the authentication system allows an attacker to use manipulated values in the X-Forwarded-Host header to alter the URLs generated by the application. A successful exploit could redirect authenticated users to malicious sites following login procedures or interaction with the interface, resulting in limited impact on confidentiality and integrity.
Weakness: CWE-601
Which versions are affected by CVE-2026-10839?
How do I fix CVE-2026-10839?
No fix has been published for CVE-2026-10839 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-10839 being exploited?
There is no known exploitation of CVE-2026-10839 in the wild and no public exploit code.
Sources
Also known as GHSA-f2w7-fcqj-g66g.