LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL…

litespeedtech LiteSpeed Web Server

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."

Do this now

Upgrade LiteSpeed Web Server to 6.3.7 build 1.

Fix it

Upgrade to LiteSpeed Web Server 6.3.7 build 1

First seen: 28 Oct 2026
Last update: 28 Oct 2026, 17:18 UTC
Fixed in: 6.3.7 build 1
Identifiers: CVE-2026-93903
CVSS: 9.4
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL…
Severity: critical. Patch status: patched.
Affected: litespeedtech LiteSpeed Web Server
Fixed in: 6.3.7 build 1
Ids: CVE-2026-93903

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."

## Steps
1. Search the repo, its CI and infra config for litespeedtech LiteSpeed Web Server. If present, report the version in use and whether it's affected.
2. Fix by release line: LiteSpeed Web Server: 6.3.7 build 1.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| LiteSpeed Web Server | fixed | 6.3.7 build 1 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-93903") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://docs.litespeedtech.com/lsws/changelog/#v6-3-7-build-1 https://nvd.nist.gov/vuln/detail/CVE-2026-93903
https://pwned.coffee/i/litespeed-web-server-lsws-before-6-3-7-build-1-mishandle-cve-2026-93903

Timeline

28 Oct 2026, 17:18 UTC
Fix status: unknown → patched.
28 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
LiteSpeed Web Server before 6.3.7 build 1 6.3.7 build 1 CVE record (CNA) checked 28 Oct
Score: CVSS 9.4 (critical). CVSS 4.0 9.4 (CNA mitre) for CVE-2026-93903
Last checked: 28 Oct 2026, 18:19 UTC

Product	Affected	Fixed in	Source
LiteSpeed Web Server	before 6.3.7 build 1	6.3.7 build 1	CVE record (CNA) checked 28 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee