CVE-2026-1406

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1406", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-01-24T19:20:25.676Z", "datePublished": "2026-01-25T12:02:05.605Z", "dateUpdated": "2026-02-23T08:53:49.084Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:53:49.084Z"}, "title": "lcg0124 BootDo Host Header AccessControlFilter.java redirectToLogin", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-601", "lang": "en", "description": "Open Redirect"}]}], "affected": [{"vendor": "lcg0124", "product": "BootDo", "versions": [{"version": "n/a", "status": "affected"}], "modules": ["Host Header Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in lcg0124 BootDo up to 5ccd963c74058036b466e038cff37de4056c1600. Affected by this vulnerability is the function redirectToLogin of the file AccessControlFilter.java of the component Host Header Handler. This manipulation of the argument Hostname causes open redirect. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-01-24T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-01-24T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-01-26T18:32:49.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Tom132432 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.342794", "name": "VDB-342794 | lcg0124 BootDo Host Header AccessControlFilter.java redirectToLogin", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.342794", "name": "VDB-342794 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.736271", "name": "Submit #736271 | BootDo web V1.0 Host header injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/webzzaa/CVE-/issues/5", "tags": ["exploit", "issue-tracking"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-26T17:32:24.427379Z", "id": "CVE-2026-1406", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T17:32:29.932Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1406", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T17:32:24.427379Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T17:32:27.263Z"}}], "cna": {"title": "lcg0124 BootDo Host Header AccessControlFilter.java redirectToLogin", "credits": [{"lang": "en", "type": "reporter", "value": "Tom132432 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "lcg0124", "modules": ["Host Header Handler"], "product": "BootDo", "versions": [{"status": "affected", "version": "n/a"}]}], "timeline": [{"lang": "en", "time": "2026-01-24T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-01-24T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-01-26T18:32:49.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.342794", "name": "VDB-342794 | lcg0124 BootDo Host Header AccessControlFilter.java redirectToLogin", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.342794", "name": "VDB-342794 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.736271", "name": "Submit #736271 | BootDo web V1.0 Host header injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/webzzaa/CVE-/issues/5", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in lcg0124 BootDo up to 5ccd963c74058036b466e038cff37de4056c1600. Affected by this vulnerability is the function redirectToLogin of the file AccessControlFilter.java of the component Host Header Handler. This manipulation of the argument Hostname causes open redirect. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "Open Redirect"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:53:49.084Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1406", "state": "PUBLISHED", "dateUpdated": "2026-02-23T08:53:49.084Z", "dateReserved": "2026-01-24T19:20:25.676Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-01-25T12:02:05.605Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Host Header Handler"], "product": "BootDo", "vendor": "lcg0124", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in lcg0124 BootDo up to 5ccd963c74058036b466e038cff37de4056c1600. Affected by this vulnerability is the function redirectToLogin of the file AccessControlFilter.java of the component Host Header Handler. This manipulation of the argument Hostname causes open redirect. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available."}, {"lang": "es", "value": "Se determin\u00f3 una vulnerabilidad en lcg0124 BootDo hasta 5ccd963c74058036b466e038cff37de4056c1600. Afectada por esta vulnerabilidad es la funci\u00f3n redirectToLogin del archivo AccessControlFilter.java del componente Host Header Handler. Esta manipulaci\u00f3n del argumento Hostname causa redirecci\u00f3n abierta. El ataque puede ser iniciado remotamente. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. Este producto utiliza un modelo de lanzamiento continuo para entregar actualizaciones continuas. Como resultado, la informaci\u00f3n de versi\u00f3n espec\u00edfica para lanzamientos afectados o actualizados no est\u00e1 disponible."}], "id": "CVE-2026-1406", "lastModified": "2026-06-17T10:15:43.250", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1406", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-26T17:32:24.427379Z", "version": "2.0.3"}}]}, "published": "2026-01-25T12:15:46.983", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/webzzaa/CVE-/issues/5"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.342794"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.342794"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.736271"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T02:55:15.941350+00:00", "value": {"mitigation_remediation": ["Patch BootDo to a revision that contains the commit 5ccd963c74058036b466e038cff37de4056c1600, which addresses the redirectToLogin behavior.", "Validate the Host header so that only known, trusted hostnames are accepted before performing redirects or enforce that redirects target absolute URLs within the same domain.", "Deploy a web application firewall or similar runtime protection that detects and blocks open\u2011redirect attempts based on patterns in the Host header or redirect URLs."], "summary": {"action": "Patch", "impact": "Open Redirect"}, "threat_synthesis": {"affected_systems": "The affected product is lcg0124 BootDo, a web application built on the BootDo framework. Any deployment up to the code commit 5ccd963c74058036b466e038cff37de4056c1600 is vulnerable. No specific version numbers are listed due to the product\u2019s rolling\u2011release model.", "description_and_impact": "The vulnerability is an open redirect in the redirectToLogin function of the Host Header Handler. Manipulating the Host header can cause the application to redirect users to arbitrary URLs, which can be used for phishing or drive\u2011by attacks. This weakness allows an attacker to influence user navigation without needing to compromise the system, impacting user trust and potentially leading to credential theft.", "risk_and_exploitability": "The CVSS base score of 5.1 places the problem in the medium severity range, and the EPSS score of less than 1% suggests that the likelihood of exploitation is low in the current environment. The vulnerability is not yet listed in CISA\u2019s KEV catalog. An attacker can trigger the exploit remotely by sending a crafted HTTP request with a malicious Host header that causes the application to redirect the victim to an attacker\u2011controlled site. Because the application appears to rely on the Host header without proper validation, successful exploitation would depend only on network connectivity to the target and the victim\u2019s willingness to click the redirected link."}}}}, "created": "2026-01-26T11:48:04.897108+00:00", "updated": "2026-04-18T03:00:10.330858+00:00", "vendors": ["lcg0124", "lcg0124$PRODUCT$bootdo"]}