CVE-2026-1406
Last modified
CVE-2026-1406 is a low-severity vulnerability rated 3.5/10 on the CVSS scale. A vulnerability was determined in lcg0124 BootDo up to 5ccd963c74058036b466e038cff37de4056c1600. Affected by this vulnerability is the function redirectToLogin of the file AccessControlFilter.java of the component Host Header Handler. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
A vulnerability was determined in lcg0124 BootDo up to 5ccd963c74058036b466e038cff37de4056c1600. Affected by this vulnerability is the function redirectToLogin of the file AccessControlFilter.java of the component Host Header Handler. This manipulation of the argument Hostname causes open redirect. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-1406?
How severe is CVE-2026-1406?
How do I fix CVE-2026-1406?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-14054Insufficient policy enforcement in Network in Google Chrome …4.3
- CVE-2026-14055Insufficient validation of untrusted input in Device Trust i…9.6
- CVE-2026-14056Insufficient validation of untrusted input in Media in Googl…9.6
- CVE-2026-14057Inappropriate implementation in FedCM in Google Chrome prior…4.3
- CVE-2026-14058Insufficient policy enforcement in Parser in Google Chrome p…4.3
- CVE-2026-14059Insufficient policy enforcement in Related-Website-Sets in G…6.5
- CVE-2026-14060Insufficient validation of untrusted input in Chromoting in …7.8
- CVE-2026-14061Inappropriate implementation in Dawn in Google Chrome prior …6.5
- CVE-2026-14062Inappropriate implementation in Views in Google Chrome on Ch…5.9
- CVE-2026-14063Out of bounds read in Chromecast in Google Chrome prior to 1…5.7
- CVE-2026-14064Use after free in PageInfo in Google Chrome on Android prior…7.5
- CVE-2026-14065Insufficient validation of untrusted input in PageInfo in Go…6.5
Are you affected by CVE-2026-1406?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST