Skip to content
OpenAdvisories
Medium · 5.1 CVE-2026-10836 EUVD-2026-37678GHSA-6pqv-g4gv-cwmh

Improper neutralization of HTTP headers in Password Manager

Published Jun 17, 2026 · Updated Jun 17, 2026 · Assigned by INCIBE

Description

Improper handling of HTTP headers that allows a remote attacker to manipulate the value of the Host header using specially crafted requests. A successful exploit could result in the generation of manipulated links or responses, potentially leading to limited information disclosure or compromising the integrity of dependent services.

Affected products

VendorProductAffectedFixed
Password Manager Password Manager < 08/07/2025 08/07/2025

References