{"id":"CVE-2025-67502","aliases":["GHSA-5923-r76v-mprm","PYSEC-2026-1948"],"url":"https://o3.security/vulnerability/CVE-2025-67502","summary":"Taguette does not safeguard against Open Redirect","details":"Taguette is an open source qualitative research tool. In versions 1.5.1 and below,  attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without any validation. This can be exploited for phishing attacks where victims believe they are interacting with a trusted Taguette instance but are redirected to a malicious site designed to steal credentials or deliver malware. This issue is fixed in version 1.5.2.","published":"2025-12-09T23:53:39.474Z","modified":"2026-07-15T01:49:06.189572488Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"taguette","fixedVersion":"1.5.2"}],"fix":{"url":"https://github.com/remram44/taguette/commit/67de2d2612e7e2572c61cd9627f89c2bfd0f2a36","label":"remram44/taguette@67de2d2"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67502.json"},{"type":"ADVISORY","url":"https://github.com/remram44/taguette/security/advisories/GHSA-5923-r76v-mprm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67502"},{"type":"FIX","url":"https://github.com/remram44/taguette/commit/67de2d2612e7e2572c61cd9627f89c2bfd0f2a36"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T01:49:06.189572488Z"}}