CVE-2025-40710: Host Header Injection (HHI) in the Hotspot Shield VPN client
Host Header Injection (HHI) vulnerability in the Hotspot Shield VPN client, which can induce unexpected behaviour when accessing third-party web applications through the VPN tunnel. Although such applications do not present this vulnerability per se, the use of the tunnel, together with a forged Host header, can cause the VPN client to redirect or forward HTTP requests to servers other than those originally intended, leading to consequences such as open redirects or delivery of traffic to infrastructure controlled by an attacker. This does not imply a flaw in the target applications, but in how the VPN client internally handles outgoing headers and requests.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40710?
CVE-2025-40710 has been classified as a moderate severity vulnerability due to its potential to cause unexpected behavior in third-party web applications.
How does CVE-2025-40710 impact users of the Hotspot Shield VPN client?
CVE-2025-40710 can lead to security risks when users access web applications through the VPN tunnel, affecting data integrity and privacy.
How do I fix CVE-2025-40710 in the Hotspot Shield VPN client?
To fix CVE-2025-40710, users should update to the latest version of the Hotspot Shield VPN client where the vulnerability has been patched.
What is Host Header Injection in the context of CVE-2025-40710?
Host Header Injection in CVE-2025-40710 occurs when the application incorrectly handles headers, potentially allowing for manipulation of web requests.
Are there any mitigations available for CVE-2025-40710 before applying the patch?
Before applying the patch for CVE-2025-40710, users should limit the use of third-party web applications through the VPN and review the application's headers for security.