CVE-2026-54915: Tautulli

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes from the user-controlled redirect_uri parameter but leaves tab, line-feed, and carriage-return characters intact. With the default root HTTP_ROOT configuration, CherryPy HTTPRedirect passes the resulting value to urllib.parse.urljoin, which can resolve the whitespace-bearing path to an attacker-controlled external origin. A user who follows a crafted link can therefore be redirected outside Tautulli for phishing or post-login redirect-flow abuse, while custom non-root HTTP_ROOT configurations are not affected by this bypass. This issue is fixed in version 2.17.2.

Affected products

• Tautulli Tautulli: before 2.17.2 (fixed in 2.17.2)

Published 2026-09-21. Last modified 2026-09-24.