CVE-2026-54215 is an open redirect vulnerability (CWE-601) in Tobit Laboratories AG TeamDavid's Webbox component. The issue arises from improper validation of the 'replyUrl' parameter, enabling attackers to create URLs that redirect users to untrusted external websites. This can be exploited to deceive users into visiting malicious sites under the guise of a trusted domain. The vulnerability affects versions of TeamDavid up to and including Rollout 524. There is no vendor advisory or patch information available at this time.

Successful exploitation can lead to phishing attacks by redirecting users from a trusted domain to malicious sites. This may result in credential theft or other social engineering attacks. The vulnerability does not directly compromise the application or user data but facilitates user deception.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users and administrators should be cautious with URLs containing the 'replyUrl' parameter and consider implementing additional validation or filtering at the application or network level to prevent open redirects.