Is CVE-2026-77433 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77433 being exploited in the wild.

How severe is CVE-2026-77433?

Medium severity, with a CVSS score of 6.1, published 9 November 2026.

Which products and versions are affected?

Kiwi TCMS 16.1 and earlier; kiwitcms (PyPI) <= 12.4, ECOSYSTEM:introduced=0,last_affected=12.4.

Is there a fix for CVE-2026-77433?

Yes: fixed in 16.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77433 attacked?

It is attacked over the network.

Am I affected by CVE-2026-77433?

Check whether you run Kiwi TCMS or kiwitcms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77433: Kiwi TCMS account confirmation open redirect via protocol-relative URLs

Q: Is there a fix for CVE-2026-77433?

Yes: fixed in 16.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-77433 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-77433?

Check whether you run Kiwi TCMS or kiwitcms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77433 · Severity: medium · CVSS 6.1 · Published 2026-11-09

Kiwi TCMS is a test case management system used by development teams. An incomplete security fix allows attackers to craft malicious account confirmation links that redirect users to phishing pages after they confirm their accounts, potentially leading to credential theft or malware delivery.

Technologies: Kiwi TCMS, kiwitcms (PyPI). Vendors: Kiwi TCMS, PyPI.

Quick answers

Is CVE-2026-77433 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77433 being exploited in the wild.
How severe is CVE-2026-77433?: Medium severity, with a CVSS score of 6.1, published 9 November 2026.
Which products and versions are affected?: Kiwi TCMS 16.1 and earlier; kiwitcms (PyPI) <= 12.4, ECOSYSTEM:introduced=0,last_affected=12.4.
Is there a fix for CVE-2026-77433?: Yes: fixed in 16.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77433 attacked?: It is attacked over the network.
Am I affected by CVE-2026-77433?: Check whether you run Kiwi TCMS or kiwitcms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 16.2

Technical details

The account confirmation endpoint's redirect validation uses a flawed `startswith("/")` check that fails to block protocol-relative URLs like `//evil.com`. An attacker can inject a protocol-relative URL via the `next` parameter, which browsers interpret as redirecting to an external domain while bypassing the validation. The vulnerability affects version 16.1's incomplete CVE-2026-54724 fix and all earlier releases.

Affected products

Kiwi TCMS Kiwi TCMS 16.1 and earlier

Identifiers

CVE-2026-77433
GHSA-gcwf-c25f-p9rv

Timeline

2026-11-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.