PyPI/kiwitcms CVE-2026-54724: medium 6.1, EPSS 0.35%
Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 12.4 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-hmj5-jm8h-h9fh
- https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-hmj5-jm8h-h9fh
- https://github.com/kiwitcms/Kiwi
- https://github.com/kiwitcms/Kiwi/releases/tag/v16.1
- https://kiwitcms.org/blog/kiwi-tcms-team/2026/06/24/kiwi-tcms-161
CVE-2026-54724 · published · modified · JSON