Quick answers
- Is CVE-2026-10839 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-10839 being exploited in the wild.
- How severe is CVE-2026-10839?
- Informational severity, with a CVSS score of 5.1, published 17 June 2026.
- Which products and versions are affected?
- eusonlito (Github) Password Manager versions prior to August 7, 2025.
- Is there a fix for CVE-2026-10839?
- A patch was published on 2025-08-07: Vulnerabilities fixed by the development team. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-10839 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-10839?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An open redirection vulnerability (CWE-601) exists in the authentication system of Password Manager due to insufficient validation of the X-Forwarded-Host HTTP header. By supplying a manipulated value in this header, a remote attacker can influence the URLs generated by the application. When an authenticated user completes a login or interacts with specific interface elements, they may be redirected to an attacker-controlled domain. This vulnerability requires user interaction (clicking a link) and can be leveraged for phishing or credential harvesting. The issue was addressed in the update released on August 7, 2025.
Affected products
- eusonlito (Github) Password Manager versions prior to August 7, 2025
Timeline
- 2025-08-07: patched: Vulnerabilities fixed by the development team.
- 2026-05-06: disclosed: Initial disclosure by INCIBE-CERT.
- 2026-06-17: advisory: CVE published in the National Vulnerability Database (NVD).