CVE-2026-54215 PUBLISHED

TeamDavid: Open Redirect via the 'replyUrl' parameter

Assigner: NCSC.ch
Reserved: 12.06.2026 Published: 07.08.2026 Updated: 07.08.2026

Tobit Laboratories AG TeamDavid's Webbox contains an open redirect vulnerability via the “replyUrl” parameter. An attacker can exploit this vulnerability to craft a URL within the application that, when visited, redirects the user’s browser to an arbitrary third-party site. This can be abused for phishing attacks, where users receive a trusted domain link but are redirected to a phishing website. This issue affects TeamDavid through Rollout 524.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS Score: 5.3

Product Status

Vendor Tobit Laboratories AG
Product TeamDavid
Versions Default: unaffected
  • affected from 0 to Rollout 524 (incl.)

Credits

  • Dario Weiss of InfoGuard Labs finder

References

Problem Types

  • CWE-601 URL redirection to untrusted site ('open redirect') CWE