CVE-2026-13163

Name of the Vulnerable Software and Affected Versions Mailerup versions prior to 1.0.0

Description An open redirect issue exists in the safe redirect() function of the click-tracking endpoint '/c//'. Remote unauthenticated attackers can redirect users to arbitrary external sites to perform phishing attacks by manipulating the u query parameter. This occurs because the destination host is not restricted to an allowlist, and a signing.BadSignature exception is silently caught, removing the requirement for a valid signed token. While the URL scheme is validated to block javascript: and data: schemes, the lack of host validation allows the redirect.

Recommendations Update to version 1.0.0 or later. As a temporary mitigation, restrict access to the '/c//' endpoint or avoid using the u query parameter until the update is applied.