CVE-2026-54724
Received Received - Intake

Open Redirect Vulnerability in Kiwi TCMS

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks that allowlist the organization's domain, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-54724
EUVD
EUVD-2026-78673

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kiwi_tcms kiwi_tcms 16.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54724 is an open redirect vulnerability in Kiwi TCMS versions 16.0 and earlier. It allows unauthenticated attackers to craft URLs on a legitimate Kiwi TCMS instance that redirect victims to arbitrary external domains. The vulnerability exists in the account confirmation endpoint where the next parameter is not properly validated.

Detection Guidance

To detect this vulnerability, check Kiwi TCMS instances running versions 16.0 or earlier for suspicious account confirmation URLs containing unvalidated 'next' parameters. Inspect web server logs for redirect patterns to external domains from trusted Kiwi TCMS hosts. No specific commands are provided in the context.

Impact Analysis

This vulnerability can be exploited for phishing attacks by redirecting users to malicious sites that appear to come from a trusted Kiwi TCMS domain. It may bypass email security filters and link-reputation checks, leading to credential theft, malware delivery, or exploitation of trust in internal tools.

Mitigation Strategies

Immediately upgrade Kiwi TCMS to version 16.1 or later. If upgrading is not possible, apply the security fix from commit 93fe8bb94dd79212fda9a1d5aa6db8594d0b4e06 to validate the 'next' parameter in the account confirmation endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54724. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart