Vulnerability-Lookup

CVE-2026-54724 (GCVE-0-2026-54724)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:34 – Updated: 2026-09-15 16:56

Title

Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint

Summary

Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks that allowlist the organization's domain, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 16:53 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/kiwitcms/Kiwi/security/advisor…	x_refsource_CONFIRM
https://github.com/kiwitcms/Kiwi/commit/93fe8bb94…	x_refsource_MISC
https://github.com/kiwitcms/Kiwi/releases/tag/v16.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
kiwitcms	Kiwi	Affected: < 16.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54724",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T16:53:12.255993Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T16:56:25.815Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kiwi",
          "vendor": "kiwitcms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 16.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks that allowlist the organization\u0027s domain, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:34:26.102Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh"
        },
        {
          "name": "https://github.com/kiwitcms/Kiwi/commit/93fe8bb94dd79212fda9a1d5aa6db8594d0b4e06",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kiwitcms/Kiwi/commit/93fe8bb94dd79212fda9a1d5aa6db8594d0b4e06"
        },
        {
          "name": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.1"
        }
      ],
      "source": {
        "advisory": "GHSA-hmj5-jm8h-h9fh",
        "discovery": "UNKNOWN"
      },
      "title": "Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54724",
    "datePublished": "2026-09-15T15:34:26.102Z",
    "dateReserved": "2026-06-15T23:07:33.232Z",
    "dateUpdated": "2026-09-15T16:56:25.815Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54724",
      "date": "2026-09-18",
      "epss": "0.0026",
      "percentile": "0.18068"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Kiwi",
                "vendor": "kiwitcms",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 16.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks that allowlist the organization\u0027s domain, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1."
          }
        ],
        "id": "CVE-2026-54724",
        "lastModified": "2026-09-15T17:17:21.383",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-54724",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T16:53:12.255993Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-15T16:17:14.417",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kiwitcms/Kiwi/commit/93fe8bb94dd79212fda9a1d5aa6db8594d0b4e06"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-601"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-54724",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-15T16:53:12.255993Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-15T16:56:21.887Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Kiwi",
              "vendor": "kiwitcms",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 16.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks that allowlist the organization\u0027s domain, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-601",
                  "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-15T15:34:26.102Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh"
            },
            {
              "name": "https://github.com/kiwitcms/Kiwi/commit/93fe8bb94dd79212fda9a1d5aa6db8594d0b4e06",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/kiwitcms/Kiwi/commit/93fe8bb94dd79212fda9a1d5aa6db8594d0b4e06"
            },
            {
              "name": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.1"
            }
          ],
          "source": {
            "advisory": "GHSA-hmj5-jm8h-h9fh",
            "discovery": "UNKNOWN"
          },
          "title": "Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-54724",
        "datePublished": "2026-09-15T15:34:26.102Z",
        "dateReserved": "2026-06-15T23:07:33.232Z",
        "dateUpdated": "2026-09-15T16:56:25.815Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54724

Vulnerability from fkie_nvd - Published: 2026-09-15 16:17 - Updated: 2026-09-15 17:17

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/kiwitcms/Kiwi/commit/93fe8bb94dd79212fda9a1d5aa6db8594d0b4e06
	security-advisories@github.com	https://github.com/kiwitcms/Kiwi/releases/tag/v16.1
	security-advisories@github.com	https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Kiwi",
          "vendor": "kiwitcms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 16.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks that allowlist the organization\u0027s domain, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1."
    }
  ],
  "id": "CVE-2026-54724",
  "lastModified": "2026-09-15T17:17:21.383",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54724",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-15T16:53:12.255993Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T16:17:14.417",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kiwitcms/Kiwi/commit/93fe8bb94dd79212fda9a1d5aa6db8594d0b4e06"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-HMJ5-JM8H-H9FH

Vulnerability from github – Published: 2026-07-06 21:27 – Updated: 2026-07-06 21:49

Summary

Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint

Details

Summary

An open redirect vulnerability in the account confirmation endpoint allows an unauthenticated attacker to craft a URL hosted on a legitimate Kiwi TCMS instance that redirects victims to an arbitrary external domain. The attack surface is particularly relevant for phishing campaigns targeting Kiwi TCMS users, as the malicious link originates from a trusted organizational hostname.

Impact

This is an open redirect vulnerability (CWE-601). Any unauthenticated attacker can exploit it against any user of a Kiwi TCMS deployment.

The primary risk is phishing. Because Kiwi TCMS is typically deployed as an internal tool for engineering and QA teams, a redirect from the organization's own hostname carries high implicit trust. An attacker can use this endpoint to: - Redirect victims to a credential-harvesting page styled to match the Kiwi TCMS or corporate SSO login. - Bypass email security filters and link-reputation checks that allowlist the organization's domain. - Distribute malware via a convincing "confirm your account" lure.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "kiwitcms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "12.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54724"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-06T21:27:27Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nAn open redirect vulnerability in the account confirmation endpoint allows an unauthenticated attacker to craft a URL hosted on a legitimate Kiwi TCMS instance that redirects victims to an arbitrary external domain. The attack surface is particularly relevant for phishing campaigns targeting Kiwi TCMS users, as the malicious link originates from a trusted organizational hostname.\n\n### Impact\n\nThis is an open redirect vulnerability (CWE-601). Any unauthenticated attacker can exploit it against any user of a Kiwi TCMS deployment.\n\nThe primary risk is phishing. Because Kiwi TCMS is typically deployed as an internal tool for engineering and QA teams, a redirect from the organization\u0027s own hostname carries high implicit trust. An attacker can use this endpoint to:\n- Redirect victims to a credential-harvesting page styled to match the Kiwi TCMS or corporate SSO login.\n- Bypass email security filters and link-reputation checks that allowlist the organization\u0027s domain.\n- Distribute malware via a convincing \"confirm your account\" lure.",
  "id": "GHSA-hmj5-jm8h-h9fh",
  "modified": "2026-07-06T21:49:19Z",
  "published": "2026-07-06T21:27:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kiwitcms/Kiwi"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.1"
    },
    {
      "type": "WEB",
      "url": "https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/24/kiwi-tcms-161"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint"
}

PYSEC-2026-2552

Vulnerability from pysec - Published: 2026-07-13 15:46 - Updated: 2026-07-13 16:04

Details

Summary

Impact

This is an open redirect vulnerability (CWE-601). Any unauthenticated attacker can exploit it against any user of a Kiwi TCMS deployment.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Impacted products

Name	purl
kiwitcms	pkg:pypi/kiwitcms

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "kiwitcms",
        "purl": "pkg:pypi/kiwitcms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "12.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0",
        "10.1",
        "10.2",
        "10.3",
        "10.3.999",
        "10.4",
        "10.5",
        "11.0",
        "11.1",
        "11.3",
        "11.4",
        "11.5",
        "11.6",
        "11.7",
        "12.0",
        "12.1",
        "12.2",
        "12.3",
        "12.4",
        "6.10",
        "6.11",
        "6.2.1",
        "6.3",
        "6.4",
        "6.5",
        "6.5.3",
        "6.6",
        "6.7",
        "6.8",
        "6.9",
        "7.0",
        "7.1",
        "7.2",
        "7.2.1",
        "7.3",
        "8.0",
        "8.1",
        "8.1.99",
        "8.2",
        "8.3",
        "8.4",
        "8.5",
        "8.6",
        "8.6.1",
        "8.7",
        "8.8",
        "8.9",
        "9.0",
        "9.999"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54724",
    "GHSA-hmj5-jm8h-h9fh"
  ],
  "details": "### Summary\n\nAn open redirect vulnerability in the account confirmation endpoint allows an unauthenticated attacker to craft a URL hosted on a legitimate Kiwi TCMS instance that redirects victims to an arbitrary external domain. The attack surface is particularly relevant for phishing campaigns targeting Kiwi TCMS users, as the malicious link originates from a trusted organizational hostname.\n\n### Impact\n\nThis is an open redirect vulnerability (CWE-601). Any unauthenticated attacker can exploit it against any user of a Kiwi TCMS deployment.\n\nThe primary risk is phishing. Because Kiwi TCMS is typically deployed as an internal tool for engineering and QA teams, a redirect from the organization\u0027s own hostname carries high implicit trust. An attacker can use this endpoint to:\n- Redirect victims to a credential-harvesting page styled to match the Kiwi TCMS or corporate SSO login.\n- Bypass email security filters and link-reputation checks that allowlist the organization\u0027s domain.\n- Distribute malware via a convincing \"confirm your account\" lure.",
  "id": "PYSEC-2026-2552",
  "modified": "2026-07-13T16:04:27.774507Z",
  "published": "2026-07-13T15:46:28.941600Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kiwitcms/Kiwi"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kiwitcms/Kiwi/releases/tag/v16.1"
    },
    {
      "type": "WEB",
      "url": "https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/24/kiwi-tcms-161"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/kiwitcms"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-hmj5-jm8h-h9fh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54724"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54724 (GCVE-0-2026-54724)

FKIE_CVE-2026-54724

GHSA-HMJ5-JM8H-H9FH

Summary

Impact

PYSEC-2026-2552

Summary

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour