CVE-2026-54915 Tautulli: Open redirect via whitespace bypass in /auth/redirect
Attackers can redirect users to malicious sites via crafted links in Tautulli, enabling phishing or session abuse.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-54915?
CVE-2026-54915 is a medium-severity vulnerability in Tautulli, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes from the user-controlled redirect_uri parameter but leaves tab, line-feed, and carriage-return characters intact. With the default root HTTP_ROOT configuration, CherryPy HTTPRedirect passes the resulting value to urllib.parse.urljoin, which can resolve the whitespace-bearing path to an attacker-controlled external origin. A user who follows a crafted link can therefore be redirected outside Tautulli for phishing or post-login redirect-flow abuse, while custom non-root HTTP_ROOT configurations are not affected by this bypass. This issue is fixed in version 2.17.2.
Weakness: CWE-601
Which versions are affected by CVE-2026-54915?
How do I fix CVE-2026-54915?
No fix has been published for CVE-2026-54915 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-54915 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54915 exists.
Sources
Also known as GHSA-7c9r-fhj9-87xm.