CVE-2026-12071

Technical Description

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input,

which is appended to the redirect target in a 302 HTTP response. By

using URL-encoded characters such as “%2e” (representing a dot), an

attacker can manipulate the portion of the URL following the top-level

domain (TLD). If a similar, registerable TLD exists (for example, if

“.com” is the application’s domain, and “.company” is available for

registration), an attacker can craft a URL to redirect users to a

malicious “.company” domain. By using URL-encoded line feeds, it becomes

possible to insert arbitrary response headers in the server's HTTP

response.

This issue affects TeamDavid through Rollout 524.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References