CVE-2026-13163
Medium
Description
Open redirect vulnerability (CWE-601) in the _safe_redirect function of the click-tracking endpoint (/c/<token>/) in Mailerup <1.0.0 on all platforms allows remote unauthenticated attackers to redirect victims to arbitrary external sites and conduct phishing attacks via a crafted u query parameter, because the URL scheme is validated (blocking javascript: and data:) but the destination host is not restricted to an allowlist, and a signing.BadSignature exception is silently caught so a valid signed token is not required.
SeverityMedium
CVSS5.3
Exploit probability—
ProductMailerup
PublishedJun 24, 2026
First seenJun 24, 2026
Weakness typeCWE-601Open redirect
How to fix
Update
- Mailerup Mailerup1.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Mailerup Mailerup | v < 1.0.1 | 1.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.