CVE-2025-67502: PYSEC-2026-1948 - Open Redirect Vulnerability in Taguette

CVE-2025-67502 · Severity: medium · CVSS 5.4 · Published 2025-12-10

Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without any validation. This can be exploited for phishing attacks where victims believe they are interacting with a trusted Taguette instance but are redirected to a malicious site designed to steal credentials or deliver malware. This issue is fixed in version 1.5.2.

Technologies: taguette (PyPI), Taguette. Vendors: PyPI, Taguette.

Quick answers

Is CVE-2025-67502 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-67502 being exploited in the wild.
How severe is CVE-2025-67502?
Medium severity, with a CVSS score of 5.4, published 10 December 2025.
Which products and versions are affected?
taguette (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.2.
Is there a fix for CVE-2025-67502?
Yes. taguette (PyPI): upgrade to 1.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2025-67502?
Check whether you run taguette (PyPI) or Taguette at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • taguette (PyPI): upgrade to 1.5.2 or later
    pip install "taguette>=1.5.2"

Affected products

  • taguette (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.2
  • Taguette

Identifiers

  • CVE-2025-67502
  • GHSA-5923-r76v-mprm
  • PYSEC-2026-1948

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.