MEDIUM 6.1 GitHub
CVE-2026-77433
Kiwi TCMS account confirmation open redirect through protocol-relative URLs
## Summary
In Kiwi TCMS version 16.1, the fix for CVE-2026-54724 (open redirect via unvalidated `next` parameter) in the account confirmation endpoint is incomplete. The validation uses `startswith("/")` to check if the redirect URL is local, but this is bypassed by protocol-relative URLs like `//evil.com` which start with `/` but redirect the browser to an external attacker-controlled domain. 16.1’s incomplete mitigation still allows protocol-relative destinations and earlier releases lack the
Affected Products
- pip/kiwitcms <= 12.4
References
- https://github.com/advisories/GHSA-gcwf-c25f-p9rv
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-gcwf-c25f-p9rv
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh
- https://github.com/kiwitcms/Kiwi/pull/4458
This medium severity vulnerability with a CVSS score of 6.1 was published on 2026-11-09 via GitHub. Affected: pip/kiwitcms <= 12.4.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.