CyberRota Analysis
AI-GeneratedThe account confirmation endpoint in Kiwi TCMS versions prior to 16.1 is vulnerable due to an unvalidated next parameter, enabling unauthenticated attackers to craft malicious URLs that redirect users to arbitrary external domains. This flaw poses a risk of credential harvesting and malware delivery, as it can exploit the trusted nature of the Kiwi TCMS hostname to bypass security measures. Organizations using Kiwi TCMS should prioritize upgrading to version 16.1 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks that allowlist the organization's domain, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1.