CVE-2026-54915: Tautulli: Open redirect via whitespace bypass in /auth/redirect
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes from the user-controlled redirecturi parameter but leaves tab, line-feed, and carriage-return characters intact. With the default root HTTPROOT configuration, CherryPy HTTPRedirect passes the resulting value to urllib.parse.urljoin, which can resolve the whitespace-bearing path to an attacker-controlled external origin. A user who follows a crafted link can therefore be redirected outside Tautulli for phishing or post-login redirect-flow abuse, while custom non-root HTTPROOT configurations are not affected by this bypass. This issue is fixed in version 2.17.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tautullito a version that resolves this vulnerability.Fixed in 2.17.2 - Compensating control
If unable to upgrade immediately, set CherryPy's HTTP_ROOT to a non-default custom non-root configuration so that the whitespace bypass in /auth/redirect is not affected, per the described behavior.
Event History
Frequently Asked Questions
Which deployments are affected by this redirect bypass?
Tautulli versions before 2.17.2 are affected when HTTP_ROOT uses the default root configuration. Deployments using a custom non-root HTTP_ROOT configuration are not affected by this specific bypass.
What does an attacker need to exploit the issue?
The attacker does not need authentication and can craft a link targeting the /auth/redirect endpoint with a redirect_uri containing tab, line-feed, or carriage-return characters. Exploitation requires a user to follow that crafted link.
What is the practical impact?
A successful attack redirects the user from Tautulli to an attacker-controlled external origin. This can support phishing or abuse of post-login redirect flows, with low confidentiality and integrity impact and no availability impact indicated.
What should be done if the instance cannot be upgraded immediately?
Use a custom non-root HTTP_ROOT configuration, as the described whitespace bypass does not affect that configuration. Upgrade to Tautulli 2.17.2 when possible for the fix.