CVE-2026-54724— Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint
Quick assessment
Affected
kiwitcms Kiwi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Kiwi TCMS 是一个开源的测试管理系统。在 16.1 版本之前，其账户确认接口（account confirmation endpoint）接受了未经校验的 参数，使得未经身份验证的攻击者可以构造一个位于受信任的 Kiwi TCMS 主机名下的 URL，将受害者重定向到任意外部域名。由于该 URL 使用受信任的来源（origin），攻击者可以利用它实现以下影响： 部署用于收割凭据（credential-harvesting）的页面； 绕过邮件安全过滤器和链接信誉检查（因为这些检查通常将组织域名加入白名单）；
Possible ATT&CK Techniques 1 AI
T1566 · Phishing
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54724
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks that allowlist the organization's domain, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-54724
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54724
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54724 (1)
Vendor Advisories for CVE-2026-54724 (1)
Vendor Pages for CVE-2026-54724 (1)
-
🔗 Release Kiwi TCMS 16.1 (24 Jun 2026) · kiwitcms/Kiwi · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: Kiwi
-
CVE-2026-55630
Kiwi TCMS: Stored XSS via javascript: URI in extra_link fiel -
CVE-2025-58790
WordPress Kiwi Plugin <= 2.1.8 - Cross Site Scripting (XSS) -
CVE-2023-36809
Kiwi TCMS's misconfigured HTTP headers allow stored XSS exec -
CVE-2023-33977
Stored cross site scripting (XSS) via unrestricted file uplo -
CVE-2023-32686
kiwitcms vulnerable to stored XSS via unrestricted files upl
Same vendor: kiwitcms
-
CVE-2026-55630
Kiwi TCMS: Stored XSS via javascript: URI in extra_link fiel -
CVE-2023-36809
Kiwi TCMS's misconfigured HTTP headers allow stored XSS exec -
CVE-2023-33977
Stored cross site scripting (XSS) via unrestricted file uplo -
CVE-2023-32686
kiwitcms vulnerable to stored XSS via unrestricted files upl -
CVE-2023-30628
Kiwi TCMS has command injection vulnerability in changelog.y
Same weakness: CWE-601
-
CVE-2026-89307
HTML injection allows open redirection in WordPress theme de -
CVE-2026-91772
Halo through 2.26.1 Open Redirect via Unvalidated URI Parame -
CVE-2026-13277
Security vulnerabilities have been addressed in IBM Verify I -
CVE-2026-15412
IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5 -
CVE-2026-12985
Mattermost DCR redirect URI allowlist bypass via improper UR
V. Comments for CVE-2026-54724
No comments yet