CVE-2026-54442

The URL validation regex "^https?:/?/." added to emissary's "NavAction.java" allows protocol-relative URLs "//evil.com/..." and single-slash scheme variants "http:/evil.com" to bypass validation, enabling SSRF and open redirect attacks...