An open redirect vulnerability (CWE-601) exists in Kiwi TCMS's account confirmation endpoint, affecting versions up to and including 12.4. An unauthenticated attacker can create a URL on a legitimate Kiwi TCMS instance that redirects victims to arbitrary external domains. This can be leveraged in phishing campaigns to bypass email security filters and link reputation checks, increasing the likelihood of successful credential harvesting or malware distribution. The vulnerability impacts the confidentiality and integrity of users by enabling redirection to malicious sites, but does not affect availability.

The vulnerability allows attackers to redirect users from a trusted Kiwi TCMS domain to malicious external sites without authentication. This can lead to phishing attacks that harvest credentials or distribute malware. The implicit trust users place in the organization's hostname increases the risk of successful social engineering. There is no direct impact on system availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider implementing URL validation or filtering on the account confirmation endpoint to prevent open redirects. Additionally, user awareness training about suspicious links originating from trusted domains may reduce phishing risk.