CVE-2026-54915

5.4 MEDIUMpublic exploit available

Published 2026-09-21 · Updated 2026-09-24

AI risk analysis

Summary: The flaw allows unauthenticated users to manipulate the redirect_uri parameter, leading to potential phishing attacks or unauthorized redirects outside Tautulli.
Exploitability: Exploitation requires a user to follow a crafted link; preconditions include an unpatched version of Tautulli prior to 2.17.2 and default HTTP_ROOT configuration.
Blast radius: If exploited, this could result in data breaches or loss of control over user sessions, impacting privacy and security.
Prioritized remediation: Update Tautulli to version 2.17.2 or higher to mitigate the risk.

auth-bypassphishingredirectweb

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes from the user-controlled redirect_uri parameter but leaves tab, line-feed, and carriage-return characters intact. With the default root HTTP_ROOT configuration, CherryPy HTTPRedirect passes the resulting value to urllib.parse.urljoin, which can resolve the whitespace-bearing path to an attacker-controlled external origin. A user who follows a crafted link can therefore be redirected outside Tautulli for phishing or post-login redirect-flow abuse, while custom non-root HTTP_ROOT configurations are not affected by this bypass. This issue is fixed in version 2.17.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weaknesses

CWE-601

Public exploit & PoC references

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.