CVE-2026-13163 Overview
CVE-2026-13163 is an open redirect vulnerability [CWE-601] in Mailerup versions prior to 1.0.0. The flaw resides in the _safe_redirect function of the click-tracking endpoint /c/<token>/. Remote unauthenticated attackers can redirect victims to arbitrary external sites by supplying a crafted u query parameter. The endpoint validates the URL scheme to block javascript: and data: payloads, but it does not restrict the destination host to an allowlist. A signing.BadSignature exception is silently caught, so a valid signed token is not required to trigger the redirect.
Critical Impact
Attackers can abuse the Mailerup click-tracking domain to launch phishing campaigns that appear to originate from a trusted sender infrastructure.
Affected Products
- Mailerup versions prior to 1.0.0
- All deployment platforms running the affected click-tracking endpoint
- Self-hosted Mailerup instances exposing /c/<token>/
Discovery Timeline
- 2026-06-24 - CVE-2026-13163 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-13163
Vulnerability Analysis
Mailerup exposes a click-tracking endpoint at /c/<token>/ that logs recipient clicks and forwards the browser to the original URL. The endpoint accepts a u query parameter containing the destination URL and a signed token used to authenticate the tracking request. The _safe_redirect helper applies a scheme check to reject dangerous URI handlers such as javascript: and data:, but it omits any allowlist or same-origin check on the destination host. Attackers can therefore supply any http:// or https:// URL and have Mailerup issue an HTTP redirect to it.
The second defect lies in token verification. The endpoint calls Django's signing utilities to validate token, but the resulting signing.BadSignature exception is caught and ignored. The redirect proceeds even when the token is missing, malformed, or forged. Authentication of the request is effectively absent.
Root Cause
The root cause is incomplete input validation combined with silenced exception handling. _safe_redirect enforces only a scheme blocklist instead of a host allowlist, violating the standard guidance for [CWE-601]. The try/except block around signing.BadSignature converts a security control into a no-op, removing the cryptographic binding between the recipient and the destination URL.
Attack Vector
An attacker crafts a URL such as https://victim-mailerup.example/c/anything/?u=https://attacker.example/login and distributes it through email, chat, or social media. The browser follows the link, Mailerup ignores the bad signature, and the user is redirected to the attacker-controlled phishing page. Because the initial domain belongs to the legitimate sender, URL inspection by users and many email security gateways treats the link as trusted. Exploitation requires user interaction but no authentication.
The vendor patch is published in the upstream repository. See the GitHub commit update for the corrective changes.
Detection Methods for CVE-2026-13163
Indicators of Compromise
- HTTP 302 responses from /c/<token>/ whose Location header points to a host outside the operator's sending domains.
- Requests to the click-tracking endpoint where the token segment is missing, malformed, or repeated across unrelated recipients.
- Spikes of traffic to /c/<token>/?u= with external u parameter values that do not match any campaign destination.
Detection Strategies
- Parse web server access logs for /c/ requests and compare the decoded u parameter against the list of approved campaign destinations.
- Alert on any response where the redirect target host is not present in an internal allowlist of sender or partner domains.
- Correlate inbound clicks with the corresponding outbound mailing records to identify tokens that were never issued by Mailerup.
Monitoring Recommendations
- Forward Mailerup application logs and reverse proxy access logs to a centralized analytics platform for retention and search.
- Track the rate of signing.BadSignature events and treat sustained non-zero values as a phishing-abuse indicator.
- Monitor reputation feeds for the Mailerup hostname appearing in phishing URL reports.
How to Mitigate CVE-2026-13163
Immediate Actions Required
- Upgrade Mailerup to version 1.0.0 or later, which addresses the open redirect and related issues.
- Audit recent access logs for /c/<token>/ requests that redirected to external hosts and notify recipients of any abuse.
- Rotate signing keys used by the click-tracking subsystem after upgrading to invalidate any tokens that may have been harvested.
Patch Information
The fix is delivered through the upstream repository. The corrective changes are visible in the Mailerup security commit, which removes anonymous registration, hardens credential handling, and updates input validation in the affected views. Operators should redeploy from the patched branch and confirm that _safe_redirect enforces a host allowlist and that signing.BadSignature is no longer swallowed.
Workarounds
- Place the click-tracking endpoint behind a reverse proxy rule that blocks u parameter values whose host does not match an allowlist of approved domains.
- Disable the click-tracking feature in Mailerup configuration until the patched version is deployed.
- Add a web application firewall signature that drops requests to /c/<token>/ lacking a valid signed token format.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
