CVE-2025-71244: Spip Open Redirect Vulnerability

CVE-2025-71244 Overview

CVE-2025-71244 is an open redirect vulnerability [CWE-601] in SPIP, an open-source content management system. The flaw affects SPIP versions before 4.4.5 and 4.3.9 when the login form is overridden to operate in AJAX mode. Attackers can craft malicious URLs that redirect victims to arbitrary external sites after a successful login. The SPIP security screen does not mitigate this issue, leaving affected deployments exposed until upstream patches are applied.

Critical Impact

Attackers can leverage the trusted SPIP login flow to redirect authenticated users to attacker-controlled sites, enabling phishing and credential theft campaigns against site visitors.

Affected Products

• SPIP versions before 4.4.5
• SPIP versions before 4.3.9
• SPIP deployments with login pages overridden to AJAX mode

Discovery Timeline

• 2026-02-19 - CVE-2025-71244 published to the National Vulnerability Database
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2025-71244

Vulnerability Analysis

The vulnerability resides in the SPIP login form when configured for AJAX mode. The login handler accepts a redirect parameter without validating that the target URL points to a trusted internal location. After authentication completes, SPIP forwards the user to the supplied destination without origin checks. An attacker who lures a user to a crafted SPIP login URL can therefore land the victim on any external domain once the login flow finishes.

The issue is classified as CWE-601 (URL Redirection to Untrusted Site). Exploitation requires user interaction, since the victim must follow the malicious link and authenticate. The attack does not compromise the SPIP server itself, but it leverages the site's trusted domain to make phishing pages appear legitimate.

This vulnerability only affects sites whose login page has been overridden to operate in AJAX mode. Default SPIP installations that do not customize the login template are not impacted. The SPIP security screen, which blocks several known attack patterns, does not filter this redirect path.

Root Cause

The root cause is missing validation of the post-login redirect destination in the AJAX login flow. The application trusts user-controlled input to determine the next page, instead of restricting redirects to a same-origin allowlist.

Attack Vector

The attack is delivered over the network and requires user interaction. An attacker distributes a crafted SPIP login URL containing an external redirect target. When the victim authenticates on the legitimate SPIP site, the application forwards their browser to the attacker-controlled domain. The destination site can then impersonate the original application to harvest credentials or deliver malware.

No verified public exploit code is available for CVE-2025-71244. Technical details are described in the VulnCheck SPIP Open Redirect Advisory and the SPIP Security Update Announcement.

Detection Methods for CVE-2025-71244

Indicators of Compromise

• HTTP requests to SPIP login endpoints containing a redirect, url, or similar parameter pointing to an external domain.
• Web server access logs showing successful logins immediately followed by 3xx responses redirecting to non-local hosts.
• Referrer chains in downstream phishing reports that trace back to a legitimate SPIP-hosted login URL.

Detection Strategies

• Inspect web access logs for login form submissions where the redirect parameter resolves to a host outside the site's domain.
• Deploy WAF rules that flag absolute URLs or protocol-relative URLs in redirect parameters on /spip.php and related login endpoints.
• Correlate user reports of unexpected post-login redirects with corresponding entries in SPIP authentication logs.

Monitoring Recommendations

• Enable verbose logging on the SPIP authentication module and forward events to a central SIEM for analysis.
• Alert on anomalous outbound referrer patterns originating from the SPIP login URL.
• Track the SPIP version deployed across managed sites and flag any host still running a release earlier than 4.4.5 or 4.3.9.

How to Mitigate CVE-2025-71244

Immediate Actions Required

• Upgrade SPIP to version 4.4.5 or 4.3.9, depending on the deployed branch.
• Audit custom login templates to confirm whether AJAX mode is in use and assess exposure.
• Review recent web logs for crafted login URLs containing external redirect targets.

Patch Information

SPIP addressed the issue in versions 4.4.5 and 4.3.9. Release notes and download links are available in the SPIP Security Update Announcement. Source changes can be reviewed in the SPIP Git Repository.

Workarounds

• Revert the login page to the default SPIP template until the patched version can be deployed.
• Restrict the redirect parameter at the reverse proxy or WAF layer to same-origin destinations only.
• Disable AJAX login mode in customized templates if the upgrade cannot be applied immediately.

# Example WAF rule pattern to block external redirects on the SPIP login endpoint
# Reject requests where the post-login redirect target is not same-origin
SecRule ARGS:redirect "@rx ^(https?:)?//(?!example\.com)" \
    "id:1007244,phase:2,deny,status:400,msg:'SPIP CVE-2025-71244 open redirect attempt'"