CVE-2026-13163CWE-601

Lack of input validation in Mailerup input parameter leads to Open Redirect

Medium · published June 24, 2026

CVSS v4.0
5.3
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

Open redirect vulnerability (CWE-601) in the _safe_redirect function of the click-tracking endpoint (/c/<token>/) in Mailerup <1.0.0 on all platforms allows remote unauthenticated attackers to redirect victims to arbitrary external sites and conduct phishing attacks via a crafted u query parameter, because the URL scheme is validated (blocking javascript: and data:) but the destination host is not restricted to an allowlist, and a signing.BadSignature exception is silently caught so a valid signed token is not required.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
EPSS
0.00510 · 42.6th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-06-24T12:49Z
EPSS history
Timeline
  • 24 JUN 12:49Z
    Lack of input validation in Mailerup input parameter leads to Open Redirect
    cvelistv5