Taguette CVE-2025-67502

Exploitation requires that an attacker lure an authenticated or about-to-authenticate user to click a crafted link to a legitimate Taguette instance containing a malicious 'next' parameter - specifically against the /login handler (redirect after successful login or when an already-logged-in user visits the page) or the /cookies prompt handler (redirect after the user clicks Accept cookies). The affected code passes the user-controlled 'next' value directly to self.redirect() with no same-host or relative-URL validation in Taguette <= 1.5.1. Limiting factors: the attack requires victim user interaction (clicking the link and, for the login path, completing authentication or the cookie prompt), affects only unpatched instances below 1.5.2, and delivers no direct code execution or data access on the server - impact is limited to redirecting the victim's browser for phishing/malware delivery.

This is a genuine but moderate-priority issue, not a critical one. The CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) correctly reflects an open redirect (CWE-601): network-reachable, low complexity, no attacker authentication, but requiring victim user interaction and yielding only low confidentiality/integrity impact via the scope change to an external site. EPSS is low at 0.26% (17th percentile), which is consistent with open redirects rarely being mass-exploited automatically - they are human-driven phishing aids rather than self-propagating exploits. The vulnerability is NOT in CISA KEV (no confirmed active exploitation), but a detailed public PoC and the fixing commit are both available, lowering the bar for opportunistic abuse. The signals are internally consistent: a self-contained open-redirect flaw whose real risk is as a phishing/credential-theft enabler, amplified by the trusted appearance of a legitimate Taguette domain. No key signals conflict; the low EPSS and absence of KEV together indicate this is unlikely to see widespread automated exploitation, so prioritization should be driven mainly by product exposure to untrusted users rather than by urgency of active attack.

An attacker crafts a link such as https://victim-taguette-instance/login?next=https://attacker.example and sends it to a Taguette user via email or chat. The victim trusts the legitimate Taguette domain, logs in (or clicks Accept cookies at /cookies?next=...), and is then transparently redirected to the attacker's lookalike site that harvests credentials or serves malware. A working PoC with three test cases (/login, /cookies, and already-logged-in redirect) is publicly documented in the GHSA advisory.