LiteSpeed Web Server: Improper internal redirect URL validation

Summary

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 does not correctly validate internal redirect URLs in a specific corner case. The CVE record does not describe the exact trigger or the impact, and the CWE classification (CWE-174, double decoding) is provisional. Per the CVSS 4.0 vector, an unauthenticated attacker with low privileges could affect confidentiality, integrity and availability over the network with low complexity and no user interaction. CISA SSVC rates technical impact as total and automatable as no.

Affected

• LiteSpeed Web Server (LSWS) versions 0 to before 6.3.7 build 1
• OpenLiteSpeed: no statement found in the sources
• Hosting environments with LSWS and customer accounts are the most relevant context

Fixed in

• Fixed in LSWS 6.3.7 build 1
• Vendor changelog lists later 6.3.7 builds (current top entry: Build 7, released October 29, 2026); use the latest build

Workaround

• No vendor-validated workaround found
• Upgrading is the only documented remediation

Exploitation

• No evidence of exploitation in the wild; not listed in CISA KEV
• Public proof-of-concept claims conflict across sources and are unverified
• Assume a PoC may exist given the public disclosure

Our recommendation

• Inventory all LSWS hosts, especially internet-facing and shared-hosting systems
• Update to the latest LSWS 6.3.7 build (not only build 1), e.g. with /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7
• Verify the installed build with cat lsws/BUILD after the update
• Monitor web server logs for unusual redirect or request-routing behaviour until patched
• Keep WebAdmin disabled unless it is required

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Tautvydas-Aleliunas/CVE-2026-93903

Research sources

• LiteSpeed changelog docs.litespeedtech.com
• LiteSpeed release log www.litespeedtech.com
• Researcher advisory (GitHub) github.com
• GitHub Advisory GHSA-8x5w-4247-99g6 github.com
• OffSeq threat radar radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:22.