Tautulli CVE-2026-54915

Requires the default root HTTP_ROOT configuration of Tautulli - instances deployed under a custom non-root HTTP_ROOT path prefix are explicitly NOT affected. Exploitation is unauthenticated against the /auth/redirect endpoint but requires user interaction: the victim must follow an attacker-crafted link containing tab, line-feed, or carriage-return characters in the redirect_uri parameter. Impact is limited to redirecting the user off-site (phishing / post-login redirect-flow abuse); there is no direct code execution or data compromise on the Tautulli host itself.

This is a moderate-severity, low-priority open redirect (CWE-601) in Tautulli. The vendor CVSS of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) is consistent with the description: network-reachable and unauthenticated, but requiring victim interaction (UI:R) to click a crafted link, with only limited confidentiality/integrity impact and no availability impact. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence - the exploitation signal is therefore weak. The only cross-source corroboration comes from the vendor's own GitHub Security Advisory (GHSA-7c9r-fhj9-87xm) and the fix commit, which confirm the mechanism. Open redirects are rarely mass-exploited on their own; they are chained into phishing or OAuth/post-login redirect abuse. No conflicting signals were found, but exploitation is meaningfully gated: it only works under the default root HTTP_ROOT configuration, so deployments behind a custom non-root path prefix are not vulnerable. Overall this is a real but low-urgency issue - patch on a normal cadence rather than emergency.

An attacker crafts a link to a victim's Tautulli instance whose /auth/redirect redirect_uri parameter embeds tab/CR/LF characters, which survive the incomplete slash-stripping and cause urllib.parse.urljoin to resolve to an attacker-controlled external origin. The victim clicks the link, trusts the legitimate Tautulli hostname, and is silently redirected to a phishing page or an abused post-login redirect flow. No public exploit code is identified in the provided data, though the fix commit reveals the exact bypass characters.