CVE-2025-67502
Description
Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without any validation. This can be exploited for phishing attacks where victims believe they are interacting with a trusted Taguette instance but are redirected to a malicious site designed to steal credentials or deliver malware. This issue is fixed in version 1.5.2.
How to fix
- taguette taguette1.5.2 or later
- taguette1.5.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| taguette taguette | v < 1.5.2 | 1.5.2 |
| taguettePyPI | v < 1.5.2 | 1.5.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.