TI-2026-39538 Aliases CVE-2026-54724 GHSA-hmj5-jm8h-h9fh

Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint

LOW 27CWE-601Published 2026-09-15 · Updated 2026-09-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks that allowlist the organization's domain, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00347 28th percentileScored 2026-11-07

Fix Fixed Kiwi (kiwitcms): 16.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
kiwitcms	Kiwi	before 16.1	16.1	Patch available	CNA
—	kiwitcms (PyPI)	up to 12.4	—	No fix listed	GHSA-hmj5-jm8h-h9fh

Kiwi Vendorkiwitcms Affected before 16.1 Fixed in 16.1 Patch available CNA
kiwitcms (PyPI) Vendor— Affected up to 12.4 Fixed in — No fix listed GHSA-hmj5-jm8h-h9fh

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:kiwitcms:kiwi_tcms::::::::	—	—	kiwitcms

cpe:2.3:a:kiwitcms:kiwi_tcms:*:*:*:*:*:*:*:* Versions — — ·kiwitcms

Remediation

Fix · CNA Kiwi (kiwitcms) Fixed in 16.1

Timeline

2026-10-02 Threatist record created from CVE-2026-54724
2026-10-03 Alias added: GHSA-hmj5-jm8h-h9fh

References

Other 5

TI-2023-14429 Kiwi TCMS unrestricted file upload vulnerability CVSS 3.1CRITICAL 9.0
TI-2023-14444 Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow CVSS 3.1HIGH 8.8
TI-2023-18603 Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox CVSS 3.1HIGH 8.1
TI-2023-16845 Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS CVSS 3.1HIGH 8.1
TI-2022-03753 Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi CVSS 3.1MEDIUM 5.4
TI-2023-14379 Kiwi TCMS may allow user to update email address to unverified one CVSS 3.1MEDIUM 4.3

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences