{"history":[{"alert":0,"cve":"CVE-2026-54724","id":23399,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.00347, \"percentile\": 0.28702}"},{"alert":0,"cve":"CVE-2026-54724","id":20880,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.00347, \"percentile\": 0.2856}"},{"alert":0,"cve":"CVE-2026-54724","id":18962,"kind":"epss","observed_at":1794306001,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.00347, \"percentile\": 0.28511}"},{"alert":1,"cve":"CVE-2026-54724","id":18922,"kind":"cna","observed_at":1794306001,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-54724\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-09-15T16:53:12.255993Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-09-15T16:56:25.815Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"Kiwi\", \"vendor\": \"kiwitcms\", \"versions\": [{\"status\": \"affected\", \"version\": \"< 16.1\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks that allowlist the organization's domain, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"scope\": \"CHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"version\": \"3.1\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-601\", \"description\": \"CWE-601: URL Redirection to Untrusted Site ('Open Redirect')\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-09-15T15:34:26.102Z\", \"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\"}, \"references\": [{\"name\": \"https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh\"}, {\"name\": \"https://github.com/kiwitcms/Kiwi/commit/93fe8bb94dd79212fda9a1d5aa6db8594d0b4e06\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/kiwitcms/Kiwi/commit/93fe8bb94dd79212fda9a1d5aa6db8594d0b4e06\"}, {\"name\": \"https://github.com/kiwitcms/Kiwi/releases/tag/v16.1\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/kiwitcms/Kiwi/releases/tag/v16.1\"}], \"source\": {\"advisory\": \"GHSA-hmj5-jm8h-h9fh\", \"discovery\": \"UNKNOWN\"}, \"title\": \"Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint\"}}, \"cveMetadata\": {\"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"assignerShortName\": \"GitHub_M\", \"cveId\": \"CVE-2026-54724\", \"datePublished\": \"2026-09-15T15:34:26.102Z\", \"dateReserved\": \"2026-06-15T23:07:33.232Z\", \"dateUpdated\": \"2026-09-15T16:56:25.815Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"}],"record":{"affected":[{"product":"Kiwi","vendor":"kiwitcms","versions":[{"status":"affected","version":"< 16.1"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-54724","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-15T16:53:12.255993Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-15T16:56:25.815Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"Kiwi","vendor":"kiwitcms","versions":[{"status":"affected","version":"< 16.1"}]}],"descriptions":[{"lang":"en","value":"Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks that allowlist the organization's domain, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-601","description":"CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-15T15:34:26.102Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh","tags":["x_refsource_CONFIRM"],"url":"https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh"},{"name":"https://github.com/kiwitcms/Kiwi/commit/93fe8bb94dd79212fda9a1d5aa6db8594d0b4e06","tags":["x_refsource_MISC"],"url":"https://github.com/kiwitcms/Kiwi/commit/93fe8bb94dd79212fda9a1d5aa6db8594d0b4e06"},{"name":"https://github.com/kiwitcms/Kiwi/releases/tag/v16.1","tags":["x_refsource_MISC"],"url":"https://github.com/kiwitcms/Kiwi/releases/tag/v16.1"}],"source":{"advisory":"GHSA-hmj5-jm8h-h9fh","discovery":"UNKNOWN"},"title":"Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-54724","datePublished":"2026-09-15T15:34:26.102Z","dateReserved":"2026-06-15T23:07:33.232Z","dateUpdated":"2026-09-15T16:56:25.815Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794435601,"cve":"CVE-2026-54724","description":"Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks that allowlist the organization's domain, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1.","epss":{"date":"2026-11-12","epss":0.00347,"percentile":0.28702},"epss_checked":1794522003,"first_seen":1794290405,"kev":null,"kev_checked":1794522003,"products":"kiwitcms Kiwi","references":["https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh","https://github.com/kiwitcms/Kiwi/commit/93fe8bb94dd79212fda9a1d5aa6db8594d0b4e06","https://github.com/kiwitcms/Kiwi/releases/tag/v16.1"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","provider":"GitHub_M","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint","updated_at":1794500401,"workarounds":""},"sources":[{"canonical_url":"https://github.com/advisories/GHSA-gcwf-c25f-p9rv","id":254,"publisher":"GitHub Advisory Database","title":"Kiwi TCMS account confirmation open redirect through protocol-relative URLs"}]}