CVE-2026-54215: TeamDavid Webbox Open Redirect Vulnerability

CVE-2026-54215 Overview

CVE-2026-54215 is an open redirect vulnerability [CWE-601] in Tobit Laboratories AG TeamDavid's Webbox component. The flaw resides in the replyUrl parameter, which fails to validate destination URLs before redirecting users. Attackers can craft URLs that appear to originate from the legitimate TeamDavid domain but redirect victims to attacker-controlled sites. The issue affects TeamDavid through Rollout 524.

This vulnerability primarily enables phishing campaigns. Users trust the visible domain in the malicious link, then land on credential harvesting or malware distribution pages after the redirect.

Critical Impact
Attackers can weaponize the trusted TeamDavid domain in phishing links, redirecting authenticated users to arbitrary third-party sites for credential theft or malware delivery.

Affected Products

Tobit Laboratories AG TeamDavid (Webbox component)
TeamDavid versions through Rollout 524
Deployments exposing the Webbox replyUrl parameter to untrusted input

Discovery Timeline

2026-08-07 - CVE-2026-54215 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-54215

Vulnerability Analysis

The vulnerability is a URL redirection to untrusted site issue, classified under CWE-601. TeamDavid's Webbox accepts a replyUrl query parameter intended to control post-action navigation. The application performs the redirect without verifying that the destination points to an approved host or relative path.

An attacker constructs a URL of the form https://<victim-teamdavid-host>/...?replyUrl=https://attacker.example. When a targeted user clicks the link, the Webbox endpoint issues an HTTP redirect to the attacker's domain. Because the initial hostname belongs to the legitimate TeamDavid deployment, standard link inspection and email gateway filters may treat the URL as trusted.

Exploitation requires user interaction. The attacker must convince a victim to click the crafted URL through email, chat, or another delivery channel. No authentication is required to generate or share the malicious link. Details of the disclosure are documented in the Infoguard CVE Analysis Post.

Root Cause

The root cause is missing allowlist validation on the replyUrl parameter. The Webbox handler treats externally supplied redirect targets as trusted, rather than restricting redirects to same-origin paths or a fixed list of approved destinations.

Attack Vector

The attack vector is network-based and requires user interaction. Attackers distribute the crafted URL through phishing emails, malicious advertisements, or messaging platforms. Upon click, the Webbox redirects the browser to the attacker-controlled site, which typically mimics a TeamDavid or Microsoft 365 login page to harvest credentials.

See the Infoguard CVE Analysis Post for technical details on the redirect flow and related findings.

Detection Methods for CVE-2026-54215

Indicators of Compromise

Web server access logs containing requests to Webbox endpoints with replyUrl parameters pointing to external domains
Outbound HTTP 302 responses from TeamDavid Webbox with Location headers referencing non-TeamDavid hosts
User reports of TeamDavid links that ended on unfamiliar login pages
Proxy logs showing rapid navigation from a TeamDavid host to a newly registered or low-reputation domain

Detection Strategies

Parse web and proxy logs for replyUrl values that do not match the internal TeamDavid FQDN or an allowlisted set of hosts
Alert on redirect chains where the initial hop is the TeamDavid Webbox and the final destination is external
Correlate email gateway telemetry with URL click events landing on the Webbox endpoint
Flag requests where replyUrl contains encoded schemes such as %2F%2Fattacker or protocol-relative URLs

Monitoring Recommendations

Deploy URL rewriting and click-time analysis in the email security gateway to inspect the full redirect chain
Retain Webbox access logs with query strings for at least 90 days to support incident investigation
Monitor domain reputation feeds for newly registered domains impersonating TeamDavid or Tobit branding

How to Mitigate CVE-2026-54215

Immediate Actions Required

Upgrade TeamDavid to a Rollout newer than 524 that addresses the replyUrl validation, per the David Tobit Release Notes
Audit any documented or bookmarked URLs that pass the replyUrl parameter and confirm expected destinations
Notify end users of ongoing phishing campaigns that abuse trusted-domain redirects

Patch Information

Tobit Laboratories AG addresses this issue in TeamDavid Rollouts released after Rollout 524. Administrators should consult the David Tobit Release Notes for the exact fixed version and apply the update to all Webbox-facing instances.

Workarounds

Configure a reverse proxy or web application firewall rule to block Webbox requests where replyUrl contains an absolute URL to an external host
Restrict Webbox access to authenticated internal users where feasible until the patch is applied
Strip or rewrite the replyUrl parameter at the perimeter to force redirects to a safe default landing page

bash

# Example NGINX rule to block external replyUrl values before reaching TeamDavid Webbox
location /webbox/ {
    if ($arg_replyUrl ~* "^(https?:)?//(?!teamdavid\.example\.com)") {
        return 403;
    }
    proxy_pass http://teamdavid_backend;
}