JEDI-SEC | Security Research & Digital Defense

GHSA-gcwf-c25f-p9rv: Kiwi TCMS account confirmation open redirect through protocol-relative URLs

Written by

jedisec_u136k7

in

  • Severity: MEDIUM
  • CVE: CVE-2026-77433
  • Ecosystems: pip
  • Packages: kiwitcms

## Summary

In Kiwi TCMS version 16.1, the fix for CVE-2026-54724 (open redirect via unvalidated `next` parameter) in the account confirmation endpoint is incomplete. The validation uses `startswith(“/”)` to check if the redirect URL is local, but this is bypassed by protocol-relative URLs like `//evil.com` which start with `/` but redirect the browser to an external attacker-controlled domain. 16.1’s incomplete mitigation still allows protocol-relative destinations and earlier releases lack the mitigation.

## Vulnerable Code

In `tcms/kiwi_auth/views.py`, the `Confirm` view (line ~113):

def get_redirect_url(self, *args, **kwargs):
self.url = self.request.GET.get(“next”, reverse(“core-views-index”))
if not self.url.startswith(“/”):
self.url = reverse(“core-views-index”)

The check `startswith(“/”)` passes for `//evil.com` because it begins with `/`, but browsers interpret `//evil.com` as a protocol-relative URL that redirects to `https://evil.com` (or `http://evil.com` depending on the current page’s protocol).

## Proof of Concept

GET /confirm//?next=//evil.com/phishing HTTP/1.1
Host: kiwi.example.com

Response:

HTTP/1.1 302 Found
Location: //evil.com/phishing

The browser follows the redirect to `https://evil.com/phishing`.

Verification:

>>> url = “//evil.com/phishing”
>>> url.startswith(“/”)
True # passes the check!

## Impact

An attacker can craft a confirmation link that, after the user confirms their account, redirects them to a phishing page. This is…

Source: GitHub Security Advisories · 2026-11-09

More posts