---
id: CVE-2026-112251
title: antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect
summary: >-
  A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects
  the function handleRequest of the file
  apps/clawhostgo/src/main/services/reverseProxy.ts of the component Reverse
  Proxy. Performing a manipulation of the argu…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'
cvssSource: cna
cwe:
  - CWE-601
vendor: antoinersx
product: clawhost
affected:
  - clawhost 0.0.1
  - clawhost 0.0.2
  - clawhost 0.0.3
  - clawhost 0.0.4
  - clawhost 0.0.5
  - clawhost 0.0.6
  - clawhost 0.0.7
  - clawhost 0.0.8
  - clawhost 0.0.9
  - clawhost 0.0.10
  - clawhost 0.0.11
  - clawhost 0.0.12
  - clawhost 0.0.13
  - clawhost 0.0.14
  - clawhost 0.0.15
  - clawhost 0.0.16
  - clawhost 0.0.17
  - clawhost 0.0.18
  - clawhost 0.0.19
  - clawhost 0.0.20
  - clawhost 0.0.21
  - clawhost 0.0.22
  - clawhost 0.0.23
  - clawhost 0.0.24
  - clawhost 0.0.25
  - clawhost 0.0.26
  - clawhost 0.0.27
  - clawhost 0.0.28
  - clawhost 0.0.29
  - clawhost 0.0.30
  - clawhost 0.0.31
  - clawhost 0.0.32
  - clawhost 0.0.33
  - clawhost 0.0.34
  - clawhost 0.0.35
  - clawhost 0.0.36
  - clawhost 0.0.37
  - clawhost 0.0.38
  - clawhost 0.0.39
  - clawhost 0.0.40
  - clawhost 0.0.41
  - clawhost 0.0.42
  - clawhost 0.0.43
  - clawhost 0.0.44
  - clawhost 0.0.45
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-19T18:49:45.731064Z'
exploitAvailable: true
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:49:54.959Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112251'
references:
  - url: 'https://vuldb.com/vuln/422332'
    label: >-
      VDB-422332 | antoinersx clawhost Reverse Proxy reverseProxy.ts
      handleRequest redirect
  - url: 'https://vuldb.com/vuln/422332/cti'
    label: 'VDB-422332 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-112251'
    label: CVE-2026-112251 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/986376'
    label: >-
      Submit #986376 | antoinersx  clawhost  0.0.45 Local Sensitive Logic
      Exposure Leading to token leakge
  - url: >-
      https://drive.google.com/drive/folders/1fvX6wjfHd58SzCAZd5-4Zn-mh9jqx8mz?usp=drive_link
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-10-19T19:38:06.482Z'
---

## Overview

A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRequest of the file apps/clawhostgo/src/main/services/reverseProxy.ts of the component Reverse Proxy. Performing a manipulation of the argument token results in open redirect. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `clawhost 0.0.1`
- `clawhost 0.0.2`
- `clawhost 0.0.3`
- `clawhost 0.0.4`
- `clawhost 0.0.5`
- `clawhost 0.0.6`
- `clawhost 0.0.7`
- `clawhost 0.0.8`
- `clawhost 0.0.9`
- `clawhost 0.0.10`
- `clawhost 0.0.11`
- `clawhost 0.0.12`
- `clawhost 0.0.13`
- `clawhost 0.0.14`
- `clawhost 0.0.15`
- `clawhost 0.0.16`
- `clawhost 0.0.17`
- `clawhost 0.0.18`
- `clawhost 0.0.19`
- `clawhost 0.0.20`
- `clawhost 0.0.21`
- `clawhost 0.0.22`
- `clawhost 0.0.23`
- `clawhost 0.0.24`
- `clawhost 0.0.25`
- `clawhost 0.0.26`
- `clawhost 0.0.27`
- `clawhost 0.0.28`
- `clawhost 0.0.29`
- `clawhost 0.0.30`
- `clawhost 0.0.31`
- `clawhost 0.0.32`
- `clawhost 0.0.33`
- `clawhost 0.0.34`
- `clawhost 0.0.35`
- `clawhost 0.0.36`
- `clawhost 0.0.37`
- `clawhost 0.0.38`
- `clawhost 0.0.39`
- `clawhost 0.0.40`
- `clawhost 0.0.41`
- `clawhost 0.0.42`
- `clawhost 0.0.43`
- `clawhost 0.0.44`
- `clawhost 0.0.45`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.