LinuxServer.io Heimdall 2.6.3-ls307 HTTP Header X-Forwarded-Host/Referer redirect

Summaryinfo

A vulnerability, which was classified as problematic, has been found in LinuxServer.io Heimdall 2.6.3-ls307. Affected by this issue is some unknown functionality of the component HTTP Header Handler. This manipulation of the argument X-Forwarded-Host/Referer causes redirect. The identification of this vulnerability is CVE-2025-50578. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

Detailsinfo

A vulnerability was found in LinuxServer.io Heimdall 2.6.3-ls307. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-Host/Referer with an unknown input leads to a redirect vulnerability. The CWE definition for the vulnerability is CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. As an impact it is known to affect integrity. The summary by CVE is:

LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` and `Referer`. An unauthenticated remote attacker can manipulate these headers to perform Host Header Injection and Open Redirect attacks. This allows the loading of external resources from attacker-controlled domains and unintended redirection of users, potentially enabling phishing, UI redress, and session theft. The vulnerability exists due to insufficient validation and trust of untrusted input, affecting the integrity and trustworthiness of the application.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-50578 since 06/16/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details and also a public exploit are known. The attack technique deployed by this issue is T1204.001 according to MITRE ATT&CK.

It is possible to download the exploit at medium.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• LinuxServer.io

Name

• Heimdall

Version

• 2.6.3-ls307

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion