Vulnerability · Published Jun 17, 2026 · Assigned by INCIBE
CVE-2026-10839Open redirection vulnerability in Password Manager
Medium 5.1
In plain English
A medium-severity open redirect in Password Manager from Password Manager. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Official description
Open redirection vulnerability in the authentication system allows an attacker to use manipulated values in the X-Forwarded-Host header to alter the URLs generated by the application. A successful exploit could redirect authenticated users to malicious sites following login procedures or interaction with the interface, resulting in limited impact on confidentiality and integrity.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Password Manager | Password Manager | 0 – before 08/07/2025 |
Weakness: CWE-601 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N