CVE-2025-50578

The LinuxServer.io Heimdall application (version 2.6.3-ls307 ) is vulnerable to Host Header Injection and Open Redirect attacks. The root cause is the insufficient validation and trust of untrusted input from user-supplied HTTP headers, specifically X-Forwarded-Host and Referer. An unauthenticate...