CVE-2026-54199 describes an HTTP header injection vulnerability in Tobit Laboratories AG TeamDavid's Webbox component. Specifically, the application's link storing functionality (//ServerClient_celink.htm) improperly validates input from the request body, which is appended to the redirect target in a 302 HTTP response. By injecting line feed characters, an attacker can control HTTP response headers, potentially leading to header injection attacks. The vulnerability is classified under CWE-20 (Improper Input Validation) and affects TeamDavid through Rollout 524. There is no vendor advisory or patch information available at this time.

The vulnerability allows an attacker to inject arbitrary HTTP headers by manipulating the redirect target in the 302 response. This can lead to HTTP response splitting or header injection attacks, which may be leveraged for further attacks such as cache poisoning or cross-site scripting. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and user interaction needed with limited confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid exposing the vulnerable functionality to untrusted users or inputs. Implement input validation or filtering on the redirect target parameters if possible as a temporary mitigation.