CVE-2026-94214: ST Engineering iDirect Open Redirect Flaw

CVE-2026-94214 Overview

CVE-2026-94214 is an open redirect vulnerability [CWE-601] in the Management Service component of ST Engineering iDirect Evolution and Velocity WebServer Evolution through build 20260717. The flaw resides in the /login.html endpoint, where manipulation of the Host HTTP header causes the application to construct redirect URLs pointing to attacker-controlled destinations. Attackers can exploit the issue remotely without authentication, though the attack requires user interaction to follow the redirect. Public exploit details have been released, and the vendor did not respond to disclosure attempts.

Critical Impact
Attackers can craft URLs that appear to originate from a legitimate iDirect WebServer login page but redirect victims to phishing or malware-hosting sites, enabling credential theft against satellite ground station operators.

Affected Products

ST Engineering iDirect Evolution WebServer through 20260717
ST Engineering iDirect Velocity WebServer Evolution through 20260717
Management Service component exposing /login.html

Discovery Timeline

2026-09-21 - CVE-2026-94214 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-94214

Vulnerability Analysis

The Management Service serving /login.html trusts the client-supplied Host header when generating redirect URLs. Because the application does not validate the header against an allowlist of expected hostnames, an attacker who controls the Host value can steer subsequent redirects to arbitrary external domains. This behavior matches the classic pattern captured by CWE-601: URL Redirection to Untrusted Site.

The impact is limited to integrity of the redirect target; the flaw does not directly disclose data or execute code on the server. The primary risk is phishing. Because the initial URL displayed to a victim references a legitimate iDirect satellite management host, targeted operators and network engineers are more likely to submit credentials to the attacker-controlled landing page. Public technical notes are available in the VulDB entry for CVE-2026-94214 and the GitHub disclosure report.

Root Cause

The application derives redirect targets from the inbound Host header without normalizing, validating, or comparing the value against a fixed list of trusted hostnames. Any HTTP client that can reach the login endpoint can override this header.

Attack Vector

An attacker sends or shares a crafted HTTP request to /login.html with a spoofed Host header pointing at a malicious domain. When the victim follows the link and completes the authentication flow, the Management Service issues a redirect response that sends the browser to the attacker's location. See the referenced advisory for reproduction steps.

Detection Methods for CVE-2026-94214

Indicators of Compromise

HTTP requests to /login.html containing a Host header value that does not match any deployed iDirect management hostname or virtual host.
Redirect responses (3xx) from the Management Service pointing to external, non-corporate domains.
Inbound access logs showing repeated /login.html requests from mail-gateway user agents or link-preview bots, consistent with phishing lure delivery.

Detection Strategies

Inspect reverse-proxy and web-server access logs for mismatched Host headers reaching the iDirect WebServer, and alert on any value outside the sanctioned list.
Correlate outbound proxy logs for user browsers that transition from the iDirect login FQDN to an unrelated domain within the same session.
Deploy signatures on network detection tools to flag HTTP requests whose Host header differs from the SNI or destination hostname on the same TCP flow.

Monitoring Recommendations

Enable full request logging on the Management Service, including Host, Referer, and Location headers, and forward to a centralized SIEM for correlation.
Monitor authentication events on iDirect Evolution and Velocity for logins followed by password resets from unusual geolocations, which may indicate phishing follow-through.
Track user reports of suspicious iDirect login links through the phishing-report mailbox.

How to Mitigate CVE-2026-94214

Immediate Actions Required

Place the iDirect Management Service behind a reverse proxy that rewrites or strips untrusted Host headers before they reach the application.
Restrict network access to /login.html to management VLANs, jump hosts, or VPN-terminated addresses only.
Brief satellite operations staff that iDirect login links received via email or chat should be verified against the internal management URL before use.

Patch Information

No vendor patch is available. According to the disclosure, ST Engineering was contacted early but did not respond. Track the VulDB vulnerability record for updates and monitor vendor security bulletins for a fixed build superseding 20260717.

Workarounds

Configure the fronting web server or load balancer (for example, NGINX or Apache) to enforce a fixed Host header and reject requests whose header does not match the canonical management FQDN.
Set the Content-Security-Policy and Referrer-Policy headers on responses from /login.html to limit the utility of a successful redirect for credential exfiltration.
Require multi-factor authentication for all iDirect operator accounts so that credentials captured through a redirect-based phishing page cannot be reused directly.

bash

# Example NGINX configuration: reject requests with an unexpected Host header
server {
    listen 443 ssl;
    server_name idirect-mgmt.example.internal;

    if ($host != "idirect-mgmt.example.internal") {
        return 421;
    }

    location / {
        proxy_set_header Host idirect-mgmt.example.internal;
        proxy_pass https://idirect_backend;
    }
}