CVE-2026-54915 in Tautulli
Summary
by MITRE • 09/21/2026
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes from the user-controlled redirect_uri parameter but leaves tab, line-feed, and carriage-return characters intact. With the default root HTTP_ROOT configuration, CherryPy HTTPRedirect passes the resulting value to urllib.parse.urljoin, which can resolve the whitespace-bearing path to an attacker-controlled external origin. A user who follows a crafted link can therefore be redirected outside Tautulli for phishing or post-login redirect-flow abuse, while custom non-root HTTP_ROOT configurations are not affected by this bypass. This issue is fixed in version 2.17.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
Tautulli serves as a widely utilized Python-based monitoring and tracking application designed specifically for Plex Media Server environments. It provides users with detailed insights into media consumption, server health, and user activity. The security flaw identified involves the authentication redirect mechanism within the webauth.py module, specifically affecting versions prior to 2.17.2. This vulnerability centers on an unauthenticated endpoint located at /auth/redirect, which is responsible for handling OAuth-style redirection flows after a user has authenticated with Plex or another external identity provider. The core technical deficiency lies in how this endpoint processes the redirect_uri parameter provided by the client application during the authentication handshake.
The implementation of input validation within Tautulli prior to version 2.17.2 was insufficiently robust against specific character-based bypass techniques. While the code successfully stripped forward slashes from the user-controlled redirect_uri, it failed to sanitize whitespace characters such as tabs, line feeds, and carriage returns. This incomplete sanitization creates a critical logic error because HTTP parsers and URL resolution libraries often treat certain whitespace sequences differently than standard alphanumeric or slash characters. In this specific case, the CherryPy web server framework passes the sanitized but still whitespace-containing redirect_uri value to Python’s urllib.parse.urljoin function for final path resolution.
The interaction between CherryPy's HTTPRedirect mechanism and urllib.parse.urljoin is where the vulnerability manifests technically. When urljoin processes a base URL combined with a relative or partial path containing embedded whitespace characters, it may interpret these characters in ways that effectively neutralize the intended security boundaries of the redirect logic. Specifically, certain whitespace sequences can cause the parser to ignore subsequent path components or alter the origin resolution process. This allows an attacker to craft a malicious redirect_uri that appears valid but ultimately resolves to an external domain controlled by the attacker rather than staying within the trusted Tautulli application context.
The operational impact of this vulnerability is significant, primarily facilitating phishing attacks and post-login session hijacking scenarios. An attacker can construct a specially crafted URL containing these whitespace characters embedded in the redirect_uri parameter. When a victim user clicks on such a link or interacts with an authentication flow involving this endpoint, they may be redirected to a malicious website that mimics legitimate services or captures sensitive credentials. This abuse of the post-login redirect flow undermines the integrity of the authentication process and can lead to unauthorized access if users are tricked into entering information on the attacker-controlled site.
It is important to note that the severity and exploitability of this vulnerability depend heavily on the server configuration, specifically the HTTP_ROOT setting used during Tautulli installation. The bypass described above relies on default configurations where HTTP_ROOT is set to the root path. In environments where a custom non-root HTTP_ROOT prefix is configured, the URL resolution behavior differs in a way that mitigates or prevents this specific redirect bypass. Therefore, while all users are advised to update, those with standard default installations face the highest risk of exploitation through direct link manipulation.
To mitigate this vulnerability and restore secure authentication flows, administrators must upgrade Tautulli to version 2.17.2 or later. This release includes corrected input validation logic that properly sanitizes not only forward slashes but also whitespace characters like tabs, line feeds, and carriage returns within the redirect_uri parameter. By ensuring that all potentially dangerous control characters are removed before URL resolution occurs, the application prevents attackers from manipulating the origin of the final redirect destination. Until an upgrade is performed, administrators should monitor logs for suspicious authentication attempts involving unusual character sequences in redirect parameters and consider implementing additional web application firewall rules to block requests containing embedded whitespace in query string parameters associated with authentication endpoints.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-601, which describes URL Redirection to Untrusted Site via User-Controlled Data. It also relates to CWE-20, Improper Input Validation, as the application failed to adequately sanitize user-supplied input before using it in a security-critical decision. From an adversary tactics perspective, this flaw supports ATT&CK technique T1566.002, which involves Spearphishing Link attacks where attackers send links that redirect users to malicious sites for credential harvesting or malware delivery. The exploitation of post-login redirects is also consistent with aspects of session hijacking and identity abuse found in the lateral movement and collection phases of an attack lifecycle if combined with other social engineering tactics.