---
id: CVE-2025-67502
title: Taguette is an open source qualitative research tool
summary: >-
  Taguette is an open source qualitative research tool. In versions 1.5.1 and
  below,  attackers can craft malicious URLs that redirect users to arbitrary
  external websites after authentication. The application accepts a
  user-controlled nex…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'
cwe:
  - CWE-601
vendor: taguette
product: taguette
affected:
  - taguette < 1.5.2
patched:
  - taguette 1.5.2
published: '2025-12-10'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T21:10:00.183'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-67502'
references:
  - url: >-
      https://github.com/remram44/taguette/commit/67de2d2612e7e2572c61cd9627f89c2bfd0f2a36
    label: security-advisories@github.com
  - url: >-
      https://github.com/remram44/taguette/security/advisories/GHSA-5923-r76v-mprm
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-67502'
  - url: 'https://github.com/remram44/taguette'
tags:
  - nvd
  - osv
  - pip
epss: 0.00262
epssPercentile: 0.1795
aliases:
  - GHSA-5923-r76v-mprm
  - PYSEC-2026-1948
ecosystem: pip
ingestedAt: '2026-07-08T18:25:45.823Z'
---

## Overview

Taguette is an open source qualitative research tool. In versions 1.5.1 and below,  attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without any validation. This can be exploited for phishing attacks where victims believe they are interacting with a trusted Taguette instance but are redirected to a malicious site designed to steal credentials or deliver malware. This issue is fixed in version 1.5.2.

## Affected

- `taguette < 1.5.2`

## Remediation

Upgrade past the affected range:

- `taguette 1.5.2`

## Package advisory (CVE-2025-67502)

Affected packages:

- `taguette < 1.5.2`

Patched in:

- `taguette 1.5.2`

Source: https://osv.dev/vulnerability/GHSA-5923-r76v-mprm