Description

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes from the user-controlled redirect_uri parameter but leaves tab, line-feed, and carriage-return characters intact. With the default root HTTP_ROOT configuration, CherryPy HTTPRedirect passes the resulting value to urllib.parse.urljoin, which can resolve the whitespace-bearing path to an attacker-controlled external origin. A user who follows a crafted link can therefore be redirected outside Tautulli for phishing or post-login redirect-flow abuse, while custom non-root HTTP_ROOT configurations are not affected by this bypass. This issue is fixed in version 2.17.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-21T20:17:26.333Z",
  "pubdate": "2026-09-21T20:17:26.333Z",
  "executiveSummary": "Tautulli versions prior to 2.17.2 contain an unauthenticated open redirect vulnerability located within the /auth/redirect endpoint.\nThe vulnerability arises from improper sanitization of the redirect_uri parameter, allowing attackers to bypass internal path restrictions by injecting whitespace characters such as tabs, line-feeds, or carriage-returns.\nBy manipulating these characters, an attacker can coerce the CherryPy HTTPRedirect mechanism and urllib.parse.urljoin to resolve to an arbitrary external origin.\nThis flaw enables phishing campaigns and post-login redirect-flow abuse, as authenticated users can be silently redirected to attacker-controlled domains.\nThe vulnerability is restricted to environments using the default root HTTP_ROOT configuration; custom configurations are inherently resistant to this specific exploit path.\nRisk is significant due to the lack of required authentication, allowing any remote attacker to craft malicious links for social engineering purposes.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input validation within plexpy/webauth.py. Specifically, the /auth/redirect endpoint attempts to sanitize the user-controlled redirect_uri parameter by stripping forward slashes. However, the implementation fails to account for control characters—specifically tab (\\t), line-feed (\\n), and carriage-return (\\r) characters.\nWhen a request is processed, the CherryPy HTTPRedirect utility receives the modified URI. Due to the presence of these preserved whitespace characters, the underlying urllib.parse.urljoin function incorrectly interprets the path, leading to an open redirect condition. The function effectively ignores the prefix and resolves the path to an external malicious domain provided by the attacker.\nAttack Flow: 1. An attacker crafts a URL targeting the vulnerable /auth/redirect endpoint of a Tautulli instance. 2. The attacker embeds whitespace characters within the redirect_uri parameter to circumvent the forward-slash filtration mechanism. 3. The victim clicks the crafted link, triggering the server-side redirect logic. 4. The Tautulli application, leveraging CherryPy and urllib.parse.urljoin, resolves the tainted input to an external URL. 5. The victim's browser is transparently redirected to an attacker-controlled site, facilitating credential harvesting or phishing.\nThis vulnerability is strictly dependent on the environment's HTTP_ROOT configuration. Systems operating with the default root configuration are vulnerable, while those utilizing custom non-root HTTP_ROOT configurations effectively bypass the logic flaw in the parsing flow.\nThis is an unauthenticated vulnerability, requiring no valid session or elevated privileges to execute. The scope is limited to social engineering and redirection-based attacks, which can be leveraged to compromise users post-authentication or by deceiving users into visiting malicious infrastructure while under the implied trust of the Tautulli instance."
}