CVE-2026-94216 in Evolution
Summary
by MITRE • 09/21/2026
A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This vulnerability affects the function authorize of the file /usr/sbin/webserver of the component HTTP Header Handler. Executing a manipulation of the argument Success can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The identified vulnerability resides within the ST Engineering iDirect Evolution and Velocity WebServer Evolution software, specifically affecting versions up to 20260717. This security flaw is located in the HTTP Header Handler component, which is responsible for processing incoming web requests and managing session states or authentication headers. The core of the issue lies in the authorize function within the /usr/sbin/webserver binary file. This function plays a critical role in validating user credentials and determining access rights before granting entry to protected resources. However, the implementation fails to adequately sanitize or validate input parameters related to redirection logic, creating a pathway for attackers to manipulate the flow of control during the authentication process.
The technical nature of this vulnerability is classified as an open redirect flaw, which corresponds to CWE-601 in the Common Weakness Enumeration standard. The specific mechanism involves the manipulation of the Success argument passed to the authorize function. Under normal operation, this parameter likely dictates whether a user has successfully authenticated and should be redirected to their intended destination or dashboard. By crafting a malicious request that injects a controlled value into the Success argument, an attacker can trick the web server into redirecting the victim's browser to a domain of the attacker's choosing. This bypasses standard security checks because the vulnerability exploits the trust relationship between the application and its own redirection logic rather than breaking encryption or authentication algorithms directly.
The operational impact of this open redirect is significant, particularly in the context of remote exploitation. Since the attack can be launched remotely over a network connection, an adversary does not need physical access to the system or prior authenticated credentials to initiate the exploit. The primary consequence of such a vulnerability is often used as a vector for phishing attacks. An attacker can host a malicious login page that mimics the legitimate ST Engineering interface and use this vulnerability to redirect users from a trusted URL to their fraudulent site. This increases the likelihood of success in social engineering campaigns, as victims are more likely to trust links originating from known domains like those associated with iDirect or Velocity WebServer Evolution. Additionally, open redirects can be leveraged for session hijacking if combined with other vulnerabilities that leak session tokens via referrer headers during redirections.
The severity of this issue is compounded by the fact that a public exploit has been disclosed and may be utilized by threat actors in the wild. The lack of response from ST Engineering following early contact further elevates the risk profile, as it suggests a potential delay or absence of an official patch for affected systems. Without vendor-provided updates, organizations relying on these versions must implement compensating controls to mitigate the immediate threat. Industry standards such as MITRE ATT&CK classify this behavior under techniques related to Initial Access and Credential Access, specifically where phishing is facilitated by trusted infrastructure abuse.
To mitigate this vulnerability in the absence of an official patch, administrators should consider implementing strict input validation at a network perimeter level using Web Application Firewalls that can detect and block malformed redirect parameters containing suspicious domain names or protocols like javascript: or data:. Additionally, configuring the web server to enforce absolute URLs for redirections rather than relative paths or unvalidated user inputs can prevent exploitation. If possible, restricting access to the affected components through IP whitelisting would reduce the attack surface available to remote adversaries. Continuous monitoring of authentication logs for unusual redirect patterns and ensuring that all systems are updated as soon as a vendor-approved fix becomes available remain critical steps in maintaining security posture against this disclosed threat.