Is CVE-2026-10837 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10837 being exploited in the wild.

How severe is CVE-2026-10837?

Informational severity, with a CVSS score of 5.1, published 17 June 2026.

Which products and versions are affected?

Password Manager (eusonlito) Password Manager versions prior to 2025-08-07.

Is there a fix for CVE-2026-10837?

A patch was published on 2025-08-07: Vulnerability fixed by the Password Manager team. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10837 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-10837?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10837: Password Manager open redirection via X-Forwarded-Host header

CVE-2026-10837 · Severity: info · CVSS 5.1 · Published 2026-06-17

Password Manager, an application used to store and manage credentials for various services, is vulnerable to an open redirection flaw. An attacker can send a specially crafted link to a user that appears to be legitimate but redirects them to a malicious website. This can be used in phishing campaigns to trick users into providing sensitive information or downloading malware.

Quick answers

Is CVE-2026-10837 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10837 being exploited in the wild.
How severe is CVE-2026-10837?: Informational severity, with a CVSS score of 5.1, published 17 June 2026.
Which products and versions are affected?: Password Manager (eusonlito) Password Manager versions prior to 2025-08-07.
Is there a fix for CVE-2026-10837?: A patch was published on 2025-08-07: Vulnerability fixed by the Password Manager team. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10837 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-10837?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An open redirection vulnerability (CWE-601) exists in Password Manager due to improper validation of the X-Forwarded-Host HTTP header. By manipulating this header, an attacker can craft links that cause the application to redirect users to an arbitrary external domain. This attack requires network reachability and user interaction (clicking a malicious link). The vulnerability was fixed in the update released on August 7, 2025.

Affected products

Password Manager (eusonlito) Password Manager versions prior to 2025-08-07

Timeline

2025-08-07: patched: Vulnerability fixed by the Password Manager team.
2026-05-06: advisory: Initial advisory published by INCIBE.
2026-06-17: disclosed: CVE published in NVD.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-password-manager

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.