CVE-2026-54915

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes from the user-controlled redirect_uri parameter but leaves tab, line-feed, and carriage-return characters intact. With the default root HTTP_ROOT configuration, CherryPy HTTPRedirect passes the resulting value to urllib.parse.urljoin, which can resolve the whitespace-bearing path to an attacker-controlled external origin. A user who follows a crafted link can therefore be redirected outside Tautulli for phishing or post-login redirect-flow abuse, while custom non-root HTTP_ROOT configurations are not affected by this bypass. This issue is fixed in version 2.17.2.

• CWE-601

• https://github.com/Tautulli/Tautulli/commit/07f9beaa0286f1ab3b5e6be9726c5b2de07ee9dd
• https://github.com/Tautulli/Tautulli/releases/tag/v2.17.2
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-7c9r-fhj9-87xm
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-7c9r-fhj9-87xm

Published

Sep 21, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54907Caddy Proxy Manager is a web interface for managing Caddy Se…5.3
• CVE-2026-54908Pion DTLS is a Go implementation of Datagram Transport Layer…6.3
• CVE-2026-54909pion/stun is a Go implementation of STUN. Prior to 3.1.3, XO…5.3
• CVE-2026-5491DriveLock Directory Traversal Information Disclosure Vulnera…7.5
• CVE-2026-54910FileBrowser Quantum is a free, self-hosted, web-based file m…7.7
• CVE-2026-54911UltraJSON is a fast JSON encoder and decoder written in pure…6.5
• CVE-2026-54916NetBox Device Type Library is a collection of community-sour…8.8
• CVE-2026-54917SeaweedFS is a distributed storage system for object storage…10
• CVE-2026-54918NetBox Device Type Library is a collection of community-sour…5.3
• CVE-2026-54919cpp-httplib is a C++11 single-file header-only cross platfor…7.4
• CVE-2026-5492DriveLock Directory Traversal Information Disclosure Vulnera…6.5
• CVE-2026-54920OpenEXR is the reference implementation and specification fo…0