CVE-2026-94216

Name of the Vulnerable Software and Affected Versions ST Engineering iDirect Evolution versions prior to 20260717 Velocity WebServer Evolution versions prior to 20260717

Description A remote open redirect issue exists within the HTTP Header Handler component. The flaw is located in the authorize() function of the /usr/sbin/webserver file. An attacker can trigger this by manipulating the Success argument, potentially redirecting users to an external malicious site.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.