CVE-2026-54724: Kiwi TCMS Open Redirect CSRF Vulnerability

CVE-2026-54724 Overview

Kiwi TCMS, an open source test management system, contains an open redirect vulnerability in its account confirmation endpoint prior to version 16.1. The endpoint accepts an unvalidated next parameter, allowing unauthenticated attackers to craft URLs on a trusted Kiwi TCMS hostname that redirect victims to arbitrary external domains. Attackers can weaponize the trusted origin to host credential-harvesting pages, bypass email security filters that allowlist the organization's domain, and deliver malware through convincing account-confirmation lures. The issue is fixed in version 16.1 and is tracked as [CWE-601] URL Redirection to Untrusted Site.

Critical Impact
Attackers can abuse the trusted Kiwi TCMS domain to redirect victims to attacker-controlled sites, bypassing link-reputation checks and enabling phishing campaigns.

Affected Products

Kiwi TCMS versions prior to 16.1
The account confirmation endpoint served by tcms/kiwi_auth/views.py
Deployments exposing the confirmation URL to unauthenticated users

Discovery Timeline

2026-09-15 - CVE-2026-54724 published to NVD
2026-09-15 - Last updated in NVD database
Version 16.1 - Kiwi TCMS releases security patch

Technical Details for CVE-2026-54724

Vulnerability Analysis

The vulnerability resides in the account confirmation view handler within tcms/kiwi_auth/views.py. The get_redirect_url method reads a user-supplied next query parameter and uses it as the post-confirmation redirect target without validating that the destination is a local path. An attacker can supply an absolute URL pointing to an external domain, and the application honors it.

Because the crafted link originates from a legitimate Kiwi TCMS hostname, it inherits the trust of that domain. Email gateways, secure web gateways, and link-reputation services that allowlist the organization's domain will typically pass the URL through. The victim clicks a link that appears to come from their own testing infrastructure and lands on an attacker-controlled page.

Root Cause

The root cause is missing input validation on the next parameter [CWE-601]. The original implementation defaulted to the index view only when the parameter was absent; when present, any string was accepted as the redirect target, including absolute URLs with attacker-controlled schemes and hosts.

Attack Vector

The attack requires network access to the Kiwi TCMS instance and user interaction. An attacker constructs a confirmation URL on the trusted host with a next parameter pointing to an external domain, then delivers the link through email, chat, or other channels. The victim following the link is redirected to a phishing page, malware download, or credential-harvesting form.

python

    def get_redirect_url(self, *args, **kwargs):
        self.url = self.request.GET.get("next", reverse("core-views-index"))
+       if not self.url.startswith("/"):
+           self.url = reverse("core-views-index")
+
        activation_key = kwargs["activation_key"]
        try:
            _activation_key = UserActivationKey.objects.select_related("user").get(

Source: Kiwi TCMS commit 93fe8bb. The patch rejects any next value that does not begin with a forward slash, forcing external URLs back to the local index route.

Detection Methods for CVE-2026-54724

Indicators of Compromise

Web server access logs containing requests to the account confirmation endpoint with a next query parameter whose value begins with http://, https://, //, or any non-slash character.
Referrer logs from external domains showing traffic originating from the Kiwi TCMS confirmation endpoint.
User reports of confirmation emails or links that redirected them to unexpected external pages.

Detection Strategies

Parse HTTP access logs and flag confirmation-endpoint requests where the decoded next parameter does not start with /.
Correlate outbound redirects from the Kiwi TCMS host with newly registered domains or domains not on the organization's allowlist.
Alert on spikes in traffic to the account confirmation URL that do not correspond to legitimate user registration activity.

Monitoring Recommendations

Enable verbose logging of query parameters on authentication routes and forward logs to a centralized analytics platform for retention and search.
Monitor email security gateway telemetry for outbound links referencing the confirmation endpoint with unusual next values.
Track user-reported phishing incidents that reference the Kiwi TCMS domain to identify active abuse.

How to Mitigate CVE-2026-54724

Immediate Actions Required

Upgrade Kiwi TCMS to version 16.1 or later, which includes the redirect validation fix.
Audit recent access logs for exploitation attempts against the account confirmation endpoint.
Notify users of the risk and remind them to verify destination URLs after clicking confirmation links.

Patch Information

The fix is included in Kiwi TCMS 16.1. The patch in tcms/kiwi_auth/views.py validates that the next parameter begins with /, otherwise it falls back to the internal index route. See the GitHub Security Advisory GHSA-hmj5-jm8h-h9fh and Kiwi TCMS v16.1 release notes for full details.

Workarounds

If immediate upgrade is not possible, apply the upstream patch from commit 93fe8bb to the local tcms/kiwi_auth/views.py.
Deploy a reverse-proxy rule that blocks requests to the confirmation endpoint when the next parameter contains ://, \\, or a leading //.
Restrict access to the Kiwi TCMS instance to trusted networks until the patch is applied.

bash

# Example nginx rule to block external redirect payloads on the confirmation endpoint
location ~ ^/accounts/confirm/ {
    if ($arg_next ~* "^(https?:|//|\\)") {
        return 400;
    }
    proxy_pass http://kiwi_backend;
}