What’s Vulnerable › Vulnerabilities

CVE-2025-67502: Taguette does not safeguard against Open Redirect

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-10 · updated 2026-10-14
• Weakness: CWE-601

Description

Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without any validation. This can be exploited for phishing attacks where victims believe they are interacting with a trusted Taguette instance but are redirected to a malicious site designed to steal credentials or deliver malware. This issue is fixed in version 1.5.2.

Affected products

• remram44 taguette: before 1.5.2 — fixed in 1.5.2

How to fix

Upgrade to a fixed version: remram44 taguette 1.5.2. Check the vendor advisory for mitigations.

References

• https://github.com/remram44/taguette/commit/67de2d2612e7e2572c61cd9627f89c2bfd0f2a36
• https://github.com/remram44/taguette/security/advisories/GHSA-5923-r76v-mprm

Get alerted when CVE-2025-67502 or the next vulnerability affects your stack