An open redirect flaw exists in Tautulli’s /auth/redirect endpoint, where user-controlled redirect_uri values are stripped of forward slashes but preserve whitespace characters. Because the server’s HTTP_REDIRECT component passes the remaining value to urllib.parse.urljoin, combinations of whitespace and default root configuration allow an attacker to craft a redirect_uri that points to an external origin. When a user follows the link, Tautulli redirects them out of the application, facilitating phishing or redirect‑flow abuse, while the vulnerability does not enable code execution. The weakness maps to CWE‑601, Open Redirect.

Affected systems are installations of the Tautulli monitoring tool, version 2.17.1 or earlier. The issue exists only when the application uses the default root HTTP_ROOT configuration; custom non‑root HTTP_ROOT values are not impacted. Updates to v2.17.2 and later contain the mitigation that removes the whitespace bypass.

The CVSS score of 5.4 reflects a moderate risk for attackers that can trick users into visiting malicious sites. The EPSS metric is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploits in the wild. The flaw is exploitable via a simple unauthenticated HTTP request to the redirect endpoint, making the attack vector relatively low barrier for an attacker to deliver phishing or credential‑stealing attempts.