CVE-2026-8993
Improper URL Handler Processing in D.Launcher 2 enables NTLM Credential Disclosure and SSRF attacks
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
D.Launcher 2 component of Slovak eID client ecosystem contains Improper URL Handler Processing vulnerability. Application registers multiple custom URL handlers that could be exploited to initiate full NTLM autentication or SMB connection to attacker infrastructure and to conduct SSRF (Server Side Request Forgery) attacks. User interaction is required as potential victim needs to open a specially crafted URL.
| CWE | CWE-74 CWE-200 CWE-1395 |
| Vendor | ditec a.s. |
| Product | d.launcher 2 |
| Published | Jun 2, 2026 |
| Last Updated | Jun 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for ditec a.s. d.launcher 2
Be the first to know when new medium vulnerabilities affecting ditec a.s. d.launcher 2 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Ditec a.s. / D.Launcher 2
0 < 2.0.7
References
Credits
Martin Orem from Binary House