# CVE-2025-67502: PYSEC-2026-1948 - Open Redirect Vulnerability in Taguette

Source: https://junglewise.ai/threats/cve-2025-67502-open-redirect-vulnerability-in-taguette  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-10  
License: CC BY 4.0 with a link back

CVE-2025-67502 · Severity: medium · CVSS 5.4 · Published 2025-12-10

Taguette is an open source qualitative research tool. In versions 1.5.1 and below,  attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without any validation. This can be exploited for phishing attacks where victims believe they are interacting with a trusted Taguette instance but are redirected to a malicious site designed to steal credentials or deliver malware. This issue is fixed in version 1.5.2.

Technologies: [taguette (PyPI)](https://junglewise.ai/threats/technologies/taguette), [Taguette](https://junglewise.ai/threats/technologies/taguette-taguette). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Taguette](https://junglewise.ai/threats/vendors/taguette).

## Quick answers

**Is CVE-2025-67502 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-67502 being exploited in the wild.

**How severe is CVE-2025-67502?** Medium severity, with a CVSS score of 5.4, published 10 December 2025.

**Which products and versions are affected?** taguette (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.2.

**Is there a fix for CVE-2025-67502?** Yes. taguette (PyPI): upgrade to 1.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-67502?** Check whether you run taguette (PyPI) or Taguette at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- taguette (PyPI): upgrade to 1.5.2 or later

  ```sh
  pip install "taguette>=1.5.2"
  ```


## Affected products

- taguette (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.2
- Taguette

## Identifiers

- CVE-2025-67502
- GHSA-5923-r76v-mprm
- PYSEC-2026-1948

## Related threats

- [Taguette stored XSS in tag and document metadata](https://junglewise.ai/threats/cve-2025-62528-taguette-stored-xss-in-tag-and-document-metadata)
- [Taguette password reset link poisoning](https://junglewise.ai/threats/cve-2025-62527-taguette-password-reset-link-poisoning)