CVE-2026-54915
Deferred Deferred - Pending Action

Open Redirect Vulnerability in Tautulli

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes from the user-controlled redirect_uri parameter but leaves tab, line-feed, and carriage-return characters intact. With the default root HTTP_ROOT configuration, CherryPy HTTPRedirect passes the resulting value to urllib.parse.urljoin, which can resolve the whitespace-bearing path to an attacker-controlled external origin. A user who follows a crafted link can therefore be redirected outside Tautulli for phishing or post-login redirect-flow abuse, while custom non-root HTTP_ROOT configurations are not affected by this bypass. This issue is fixed in version 2.17.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-54915
EUVD
EUVD-2026-84068

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tautulli tautulli 2.17.2
tautulli tautulli to 2.17.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54915 is an open redirect vulnerability in Tautulli, a Plex Media Server monitoring tool. The flaw exists in the unauthenticated /auth/redirect endpoint where user-controlled input in redirect_uri is improperly sanitized. The code strips forward slashes but leaves tab, line-feed, and carriage-return characters, allowing attackers to craft malicious URLs that redirect users to external domains.

Detection Guidance

Check Tautulli version with: pip show tautulli or grep version in the installation directory. If version is below 2.17.2, the system is vulnerable. Inspect web server logs for unusual redirect patterns or external domain accesses from the /auth/redirect endpoint.

Impact Analysis

This vulnerability can be exploited for phishing attacks by tricking users into following crafted links that redirect them to malicious sites. Attackers could steal session tokens via the Referer header or chain the vulnerability with post-login redirect flows to target authenticated users. The attack requires no authentication or special privileges.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling phishing attacks or unauthorized redirection of user sessions. Attackers could exploit the open redirect flaw to trick users into visiting malicious sites, potentially leading to credential theft or exposure of sensitive data. This may violate requirements for secure authentication and data protection under these regulations.

Mitigation Strategies

Upgrade Tautulli to version 2.17.2 or later immediately. If upgrading is not possible, restrict access to the /auth/redirect endpoint or modify HTTP_ROOT to a non-root path to prevent the bypass.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54915. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart