Mailerup up to 1.0.0 click-tracking Endpoint _safe_redirect

Summaryinfo

A vulnerability has been found in Mailerup up to 1.0.0 and classified as problematic. Affected is the function _safe_redirect of the component click-tracking Endpoint. The manipulation leads to redirect. This vulnerability is traded as CVE-2026-13163. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Mailerup up to 1.0.0. It has been rated as problematic. This issue affects the function _safe_redirect of the component click-tracking Endpoint. The manipulation with an unknown input leads to a redirect vulnerability. Using CWE to declare the problem leads to CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. Impacted is integrity. The summary by CVE is:

Open redirect vulnerability (CWE-601) in the _safe_redirect function of the click-tracking endpoint (/c//) in Mailerup <1.0.0 on all platforms allows remote unauthenticated attackers to redirect victims to arbitrary external sites and conduct phishing attacks via a crafted u query parameter, because the URL scheme is validated (blocking javascript: and data:) but the destination host is not restricted to an allowlist, and a signing.BadSignature exception is silently caught so a valid signed token is not required.

The weakness was shared by Xoan M. Otero Jorge as 99eb6d4586134bf3f4422093fbf47d6794ef0ee5. The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-13163 since 06/24/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

Upgrading to version 1.0.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-38759). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Mailerup

Version

• 1.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion