Low severity · published Jan 25, 2026
CVE-2026-1406
lcg0124 BootDo Host Header AccessControlFilter.java redirectToLogin
3.5
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was determined in lcg0124 BootDo up to 5ccd963c74058036b466e038cff37de4056c1600. Affected by this vulnerability is the function redirectToLogin of the file AccessControlFilter.java of the component Host Header Handler. This manipulation of the argument Hostname causes open redirect. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
BootDo · lcg0124
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1406
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1406
github.com
https://github.com/webzzaa/CVE-/issues/5
vuldb.com
https://vuldb.com/?ctiid.342794
vuldb.com
https://vuldb.com/?id.342794
vuldb.com
https://vuldb.com/?submit.736271
More from BootDo
4.3
CVE-2026-1835
lcg0124 BootDo cross-site request forgery
3.5
CVE-2026-1136
lcg0124 BootDo ContentController save cross site scripting
