The Webbox of TeamDavid by Tobit Laboratories AG improperly constructs redirect URLs by appending user-supplied input to the redirect target in a 302 HTTP response. This allows attackers to use URL-encoded characters such as '%2e' to manipulate the portion of the URL following the top-level domain, enabling redirection to malicious domains with similar TLDs. Furthermore, URL-encoded line feeds can be used to insert arbitrary HTTP response headers, potentially altering server responses. The vulnerability is classified as CWE-601 (URL redirection to untrusted site, 'open redirect'). It affects TeamDavid through Rollout 524. The CVSS 4.0 base score is 5.3 (medium severity). No known exploits in the wild or vendor patches have been reported.

Successful exploitation can cause users to be redirected to malicious websites controlled by attackers, which may facilitate phishing or other social engineering attacks. The ability to inject arbitrary HTTP response headers could lead to further manipulation of the server's HTTP responses, potentially impacting security controls or user trust. However, there is no indication of direct code execution or data breach from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround has been reported, users should exercise caution with URLs involving TeamDavid Webbox redirects and consider implementing additional controls such as URL validation or user warnings until a patch is available.