Vulnerability Description
Open redirect vulnerability (CWE-601) in the _safe_redirect function of the click-tracking endpoint (/c/<token>/) in Mailerup <1.0.0 on all platforms allows remote unauthenticated attackers to redirect victims to arbitrary external sites and conduct phishing attacks via a crafted u query parameter, because the URL scheme is validated (blocking javascript: and data:) but the destination host is not restricted to an allowlist, and a signing.BadSignature exception is silently caught so a valid signed token is not required.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-13163?
CVE-2026-13163 is a documented vulnerability. Open redirect vulnerability (CWE-601) in the _safe_redirect function of the click-tracking endpoint (/c/<token>/) in Mailerup <1.0.0 on all platforms allows remote unauthenticated attackers to redirec...
How severe is CVE-2026-13163?
CVSS scoring is not yet available for CVE-2026-13163. Check NVD for updates.
Is there a patch for CVE-2026-13163?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.