CVE-2026-54724

Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks that allowlist the organization's domain, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1.

• CWE-601

• https://github.com/kiwitcms/Kiwi/commit/93fe8bb94dd79212fda9a1d5aa6db8594d0b4e06
• https://github.com/kiwitcms/Kiwi/releases/tag/v16.1
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh

Published

Sep 15, 2026

Last Modified

Sep 15, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54719goshs is a feature-rich single-binary file server for red te…7.5
• CVE-2026-5472A flaw has been found in ProjectsAndPrograms School Manageme…6.3
• CVE-2026-54720Silverstripe Framework is a PHP framework which powers the S…5.4
• CVE-2026-54721Silverstripe UserForms provides a visual form builder for th…8.8
• CVE-2026-54722DSSRF is a Node.js library that provides a wide range of uti…8.7
• CVE-2026-54723devpi is a Python package index staging server and packaging…6.5
• CVE-2026-54725vault-secrets-webhook is a Kubernetes mutating webhook that …9.6
• CVE-2026-54727proot-distro is a utility for managing proot containers. Pri…8.2
• CVE-2026-54728bunkerweb is an Open-source and next-generation Web Applicat…6.1
• CVE-2026-54729DSSRF is a Node.js library that provides a wide range of uti…8.7
• CVE-2026-5473A vulnerability has been found in NASA cFS up to 7.0.0. The …7
• CVE-2026-54730authentik is an open-source identity provider. Prior to 2026…8.6