Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-54724Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint

Medium 6.1

In plain English

A medium-severity open redirect in Kiwi from kiwitcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 71.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks that allowlist the organization's domain, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	kiwitcms	no fix listed	GHSA-hmj5-jm8h-h9fh
PyPI	kiwitcms	no fix listed	PYSEC-2026-2552

Affected products (as reported)

Vendor	Product	Versions
kiwitcms	Kiwi	< 16.1

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh x_refsource_CONFIRM
https://github.com/kiwitcms/Kiwi/commit/93fe8bb94dd79212fda9a1d5aa6db8594d0b4e06 x_refsource_MISC
https://github.com/kiwitcms/Kiwi/releases/tag/v16.1 x_refsource_MISC