Unauthenticated redirects via unvalidated Host header

Host header injection in Parallels Remote Application Server Web Client 18.0 allows remote attackers to redirect users via crafted HTTP Host headers. The web client trusts the supplied Host value without validation or escaping and reflects it into a 303 Location redirect to an attacker-controlled domain. Exploitation requires interception of an HTTP request by a man-in-the-middle attacker; the demonstrated consequence is browser redirection and potential follow-on malicious content, with no direct command execution shown in the published evidence.