CVE-2026-54724

Name of the Vulnerable Software and Affected Versions Kiwi TCMS (affected versions not specified)

Description An open redirect issue exists in the account confirmation endpoint, allowing an unauthenticated attacker to create a URL on a legitimate instance that redirects users to an arbitrary external domain. This can be used in phishing campaigns to redirect victims to credential-harvesting pages, bypass email security filters that trust the organization's domain, or distribute malware through fake account confirmation lures.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.