CVE-2026-54215

EUVD-2026-54446

07.08.2026, 10:16

Tobit Laboratories AG TeamDavid's Webbox  contains an open redirect vulnerability via the 
“replyUrl” parameter. An attacker can exploit this vulnerability to 
craft a URL within the application that, when visited, redirects the 
user’s browser to an arbitrary third-party site. This can be abused for 
phishing attacks, where users receive a trusted domain link but are 
redirected to a phishing website. This issue affects TeamDavid through Rollout 524.

Open Redirect

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	UNKNOWN				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 37.55%

Common Weakness Enumeration

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References

https://david.tobit.software/releasenotes

https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/