CVE-2026-54724: Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter

Executive brief

Kiwi TCMS, a popular open-source test case management system, contains a security flaw that allows attackers to redirect users to malicious websites. By sending a specially crafted link that appears to come from a trusted internal server, attackers can trick employees into visiting fake login pages to steal credentials or download malware. This exploit is particularly effective for phishing because the link uses the organization's own trusted domain name.

Technical details

An open redirect vulnerability (CWE-601) exists in Kiwi TCMS versions 12.4 and earlier. The vulnerability is located in the account confirmation endpoint, where the 'next' URL parameter is not properly validated before being used in a redirection. An unauthenticated remote attacker can exploit this by crafting a URL that, when clicked by a victim, redirects them from the legitimate Kiwi TCMS domain to an arbitrary external site. This can be leveraged in phishing campaigns to bypass link filters and gain user trust. The issue is addressed in version 16.1.

Affected products

• Kiwi TCMS Kiwi TCMS <= 12.4

Timeline

• 2026-06-24: disclosed: Vulnerability reported and initial blog post published
• 2026-06-24: patched: Version 16.1 released
• 2026-07-06: advisory: GitHub Advisory published

References

• https://api.github.com/users/martindios
• https://github.com/martindios
• https://api.github.com/users/martindios/gists%7B/gist_id%7D
• https://api.github.com/users/martindios/repos
• https://avatars.githubusercontent.com/u/178078241?v=4
• https://api.github.com/users/martindios/events%7B/privacy%7D