It most definately has to be coming from your vbulletin here is the header replacement code we use to load the header links and make sure they point correctly. We use the vbulletin bburl variable in your vb options
i will do what I can to clean up server paths but that should not cause security issues. I would suggest removing any vb hacks as that is normally the cause of any vb security issues