# CVE-2026-77433: Kiwi TCMS account confirmation open redirect via protocol-relative URLs

Source: https://junglewise.ai/threats/cve-2026-77433-kiwi-tcms-account-confirmation-open-redirect-through-protocol  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-77433 · Severity: medium · CVSS 6.1 · Published 2026-11-09

Kiwi TCMS is a test case management system used by development teams. An incomplete security fix allows attackers to craft malicious account confirmation links that redirect users to phishing pages after they confirm their accounts, potentially leading to credential theft or malware delivery.

Technologies: [Kiwi TCMS](https://junglewise.ai/threats/technologies/kiwi-tcms), [kiwitcms (PyPI)](https://junglewise.ai/threats/technologies/kiwitcms). Vendors: [Kiwi TCMS](https://junglewise.ai/threats/vendors/kiwi-tcms), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-77433 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77433 being exploited in the wild.

**How severe is CVE-2026-77433?** Medium severity, with a CVSS score of 6.1, published 9 November 2026.

**Which products and versions are affected?** Kiwi TCMS 16.1 and earlier; kiwitcms (PyPI) <= 12.4, ECOSYSTEM:introduced=0,last_affected=12.4.

**Is there a fix for CVE-2026-77433?** Yes: fixed in 16.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77433 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77433?** Check whether you run Kiwi TCMS or kiwitcms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 16.2

## Technical details

The account confirmation endpoint's redirect validation uses a flawed `startswith("/")` check that fails to block protocol-relative URLs like `//evil.com`. An attacker can inject a protocol-relative URL via the `next` parameter, which browsers interpret as redirecting to an external domain while bypassing the validation. The vulnerability affects version 16.1's incomplete CVE-2026-54724 fix and all earlier releases.

## Affected products

- Kiwi TCMS Kiwi TCMS 16.1 and earlier

## Identifiers

- CVE-2026-77433
- GHSA-gcwf-c25f-p9rv

## Timeline

- 2026-11-09: disclosed

## Related threats

- [Kiwi TCMS missing authorization in database initialization page](https://junglewise.ai/threats/cve-2026-49292-kiwi-tcms-missing-authorization-in-database-initialization-page)
- [Kiwi TCMS stored XSS in TestPlan and TestCase extra_link fields](https://junglewise.ai/threats/cve-2026-55630-kiwi-tcms-stored-xss-in-testplan-and-testcase-extra-link-fields)
- [Kiwi TCMS open redirect in account confirmation endpoint](https://junglewise.ai/threats/cve-2026-54724-kiwi-tcms-open-redirect-in-account-confirmation-endpoint)
- [PYSEC-2026-1499 - Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox](https://junglewise.ai/threats/cve-2023-36809-kiwi-tcms-s-misconfigured-http-headers-allow-stored-xss-execution)
- [PYSEC-2026-1495 - kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload](https://junglewise.ai/threats/cve-2023-33977-kiwi-tcms-stored-cross-site-scripting-via-unrestricted-file)