CVE-2026-13163: Mailerup

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Open redirect vulnerability (CWE-601) in the _safe_redirect function of the click-tracking endpoint (/c/<token>/) in Mailerup <1.0.0 on all platforms allows remote unauthenticated attackers to redirect victims to arbitrary external sites and conduct phishing attacks via a crafted u query parameter, because the URL scheme is validated (blocking javascript: and data:) but the destination host is not restricted to an allowlist, and a signing.BadSignature exception is silently caught so a valid signed token is not required.

Affected products

• Mailerup Mailerup: before 1.0.1 (fixed in 1.0.1)

Published 2026-06-24. Last modified 2026-06-25.