CVE-2026-54199: TeamDavid Webbox HTTP Header Injection

CVE-2026-54199 Overview

CVE-2026-54199 is an HTTP header injection vulnerability in Tobit Laboratories AG TeamDavid's Webbox component. The flaw resides in the link storing functionality reached through //ServerClient_celink.htm. The application appends attacker-controlled data from the request body into the redirect target of a 302 HTTP response without sanitizing line feed characters. An attacker who inserts a line feed can inject arbitrary response headers. The issue affects TeamDavid through Rollout 524 and is tracked under [CWE-20: Improper Input Validation].

Critical Impact
Attackers can manipulate HTTP response headers returned by TeamDavid Webbox, enabling response splitting, cache poisoning, and open redirect scenarios that facilitate phishing and session-related attacks.

Affected Products

Tobit Laboratories AG TeamDavid Webbox
TeamDavid through Rollout 524
Webbox ServerClient_celink.htm link storing endpoint

Discovery Timeline

2026-08-07 - CVE-2026-54199 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-54199

Vulnerability Analysis

The vulnerability exists in the link storing functionality exposed at //ServerClient_celink.htm inside Tobit TeamDavid's Webbox. When a client submits a request body containing a link value, the application stores that value and then reflects it into the Location header of a 302 redirect response. Input from the request body flows directly into the header construction path without stripping or encoding CR (\r) or LF (\n) characters.

Because HTTP headers are delimited by CRLF sequences, an injected line feed terminates the redirect header and allows the attacker to append additional headers or a response body. This class of flaw is commonly referred to as HTTP response splitting or CRLF injection. The network attack vector requires user interaction, typically achieved by luring a victim to a crafted link, and yields limited confidentiality and integrity impact rather than direct code execution.

Root Cause

The root cause is improper input validation on data written into the redirect target. The link storing routine trusts the request body, appending it to the Location header without filtering control characters. See the Infoguard CVE Analysis for the underlying research context.

Attack Vector

An unauthenticated remote attacker crafts a request or URL that includes a line feed inside the link parameter processed by ServerClient_celink.htm. When a victim triggers the flow, the server emits a 302 response containing attacker-controlled headers. The attacker can leverage this to inject Set-Cookie values, poison intermediate caches, or redirect users to phishing sites hosted outside the trust boundary.

No verified proof-of-concept code has been published. Refer to the Infoguard CVE Analysis for further technical detail.

Detection Methods for CVE-2026-54199

Indicators of Compromise

Web server logs containing requests to /ServerClient_celink.htm with encoded CRLF sequences such as %0d%0a, %0a, or \n in POST bodies or query parameters.
Outbound 302 responses from TeamDavid Webbox where the Location header contains unexpected additional header fields.
Unexpected Set-Cookie values or cache-control directives in responses originating from the Webbox endpoint.

Detection Strategies

Inspect HTTP traffic to TeamDavid Webbox for line feed or carriage return byte sequences in link parameters submitted to ServerClient_celink.htm.
Alert on 302 responses whose Location header exceeds a single line or contains header separator tokens.
Correlate authentication anomalies and phishing reports with redirects sourced from TeamDavid hosts.

Monitoring Recommendations

Enable verbose access logging on the TeamDavid Webbox front-end and forward logs to a centralized analytics platform.
Monitor upstream proxies and CDNs for cache poisoning symptoms tied to Webbox response paths.
Track TeamDavid release note updates at the David Tobit Release Notes page for fixed builds.

How to Mitigate CVE-2026-54199

Immediate Actions Required

Upgrade TeamDavid beyond Rollout 524 once Tobit publishes a corrected build referenced in the David Tobit Release Notes.
Restrict external exposure of the Webbox ServerClient_celink.htm endpoint to trusted networks where feasible.
Deploy a web application firewall rule that rejects requests containing CRLF sequences in link-related parameters.

Patch Information

Tobit Laboratories tracks fixes through its rollout numbering. Administrators should consult the David Tobit Release Notes and apply the first rollout above 524 that lists CVE-2026-54199 as remediated.

Workarounds

Configure an upstream reverse proxy to strip or reject %0d, %0a, \r, and \n byte sequences in request bodies targeting ServerClient_celink.htm.
Enforce strict egress filtering on Location headers by rewriting 302 responses that contain more than a single header line.
Disable the link storing feature at the Webbox layer if it is not required by business processes.

bash

# Example NGINX rule to block CRLF sequences in Webbox link parameters
location ~* /ServerClient_celink\.htm {
    if ($request_body ~* "(\r|\n|%0d|%0a)") {
        return 400;
    }
    proxy_pass http://teamdavid_backend;
    proxy_set_header Host $host;
}