CVE-2026-10836 — Improper neutralization of HTTP headers in Password Manager

CVE-2026-10836

Improper neutralization of HTTP headers in Password Manager PUBLISHED

Description (CNA)

Improper handling of HTTP headers that allows a remote attacker to manipulate the value of the Host header using specially crafted requests. A successful exploit could result in the generation of manipulated links or responses, potentially leading to limited information disclosure or compromising the integrity of dependent services.

Affected (CNA)

Vendor / product	Versions
Password Manager / Password Manager	affected 0 before 08/07/2025; unaffected 08/07/2025

CWE

CWE-644

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-password-manager

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.