CVE-2026-54915 Details
Description
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes from the user-controlled redirect_uri parameter but leaves tab, line-feed, and carriage-return characters intact. With the default root HTTP_ROOT configuration, CherryPy HTTPRedirect passes the resulting value to urllib.parse.urljoin, which can resolve the whitespace-bearing path to an attacker-controlled external origin. A user who follows a crafted link can therefore be redirected outside Tautulli for phishing or post-login redirect-flow abuse, while custom non-root HTTP_ROOT configurations are not affected by this bypass. This issue is fixed in version 2.17.2.
An open redirect vulnerability has been identified in Tautulli versions prior to 2.17.2. The issue resides in the unauthenticated '/auth/redirect' endpoint, which processes the user-supplied 'redirect_uri' parameter. While the endpoint removes forward slashes, it fails to sanitize tab, line-feed, and carriage-return characters. This oversight allows for the construction of a redirect URL that points to an external domain, which can be exploited for phishing or to manipulate post-login redirect flows. The vulnerability is present when the default HTTP_ROOT configuration is used, as custom non-root paths are not affected.
Users can update to Tautulli version 2.17.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Tautulli/Tautulli/security/advisories/GHSA-7c9r-fhj9-87xm | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Tautulli/Tautulli/commit/07f9beaa0286f1ab3b5e6be9726c5b2de07ee9dd | [email protected] | Source CodeVendor |
| https://github.com/Tautulli/Tautulli/releases/tag/v2.17.2 | [email protected] | Release NotesVendor |
| https://github.com/Tautulli/Tautulli/security/advisories/GHSA-7c9r-fhj9-87xm | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tautulli | <= v2.17.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |