ZeroDay Findings
Sign inSign up

Findings

CVE-2025-67502

Taguette is an open source qualitative research tool.

Published Dec 10, 2025 · updated Oct 14, 2026 · taguette taguette

Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without any validation. This can be exploited for phishing attacks where victims believe they are interacting with a trusted Taguette instance but are redirected to a malicious site designed to steal credentials or deliver malware. This issue is fixed in version 1.5.2.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 10, 2025 · NIST NVD

    Detected

    Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without any validation. This can be exploited for phishing attacks where victims believe they are interacting wit

  2. Oct 14, 2026 · NIST NVD

    Updated

    Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without any validation. This can be exploited for phishing attacks where victims believe they are interacting wit

Affected

  • cpe taguette/taguetteversion unspecified

Sources

  • CVE.orgCVE-2025-67502

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2025-67502

    30-day exploitation probability 0.3%

    first.org
  • NIST NVDCVE-2025-67502

    Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP re

    nvd.nist.gov

References