CVE-2025-71244: 
NixOS vulnerability analysis and mitigation

CVE-2025-71244 is an Open Redirect vulnerability in SPIP, a popular open-source content management system, affecting versions 4.3.0 through 4.3.8 and 4.4.0 through 4.4.4. The flaw exists in the login form when operated in AJAX mode, allowing an unauthenticated attacker to craft a malicious URL that redirects victims to an arbitrary external site after login. It was published on February 19, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (Feedly).

The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site / 'Open Redirect'). The root cause is insufficient validation of the redirect target URL parameter in SPIP's login form when the site has been configured to use AJAX mode for authentication. An attacker crafts a URL pointing to the SPIP login page with a malicious redirect parameter; after the victim successfully authenticates, the application redirects them to the attacker-controlled external site without verifying the destination. Notably, this vulnerability is not mitigated by the SPIP security screen, and only affects deployments where the login page has been overridden to function in AJAX mode (Feedly, InfinitSec).

Successful exploitation enables phishing attacks by silently redirecting authenticated users to attacker-controlled websites immediately after login, potentially facilitating credential harvesting or malware delivery. The confidentiality and integrity impacts are limited (low), and there is no availability impact; however, the changed scope indicates the impact extends beyond the vulnerable component itself. The attack requires no privileges and only requires user interaction (the victim visiting the crafted URL and completing login), making it accessible to low-sophistication attackers (Feedly).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-71244 as of the available data. The EPSS score is approximately 0.026%, indicating a low probability of exploitation in the near term. The vulnerability is detectable via Nessus (plugin ID 299644) and is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

1. Reconnaissance: Identify SPIP-powered websites running versions 4.3.0–4.3.8 or 4.4.0–4.4.4 that have their login page overridden to operate in AJAX mode.
2. Craft malicious URL: Construct a URL targeting the SPIP login endpoint with a redirect parameter pointing to an attacker-controlled site (e.g., https://victim-site.com/spip.php?page=login&url=https://attacker.com).
3. Deliver to victim: Send the crafted URL to the target user via phishing email, social media, or other social engineering channels.
4. Victim authenticates: The victim visits the URL and completes the login process on the legitimate SPIP site.
5. Redirect occurs: Upon successful authentication, SPIP processes the unvalidated redirect parameter and transparently forwards the victim's browser to the attacker-controlled external site.
6. Achieve objective: The attacker's site can harvest credentials, deliver malware, or conduct further phishing against the now-authenticated victim (Feedly, InfinitSec).

• Logs: Web server access logs showing login requests with suspicious url or redirect parameters containing external domains (e.g., url=https://external-domain.com) in POST/GET parameters to the SPIP login endpoint.
• Network: Outbound HTTP 302 redirect responses from the SPIP server pointing to non-organizational external domains immediately following successful authentication events.
• Logs: SPIP application logs recording login completions followed by redirects to domains outside the site's own domain.

SPIP has released patched versions 4.3.9 and 4.4.5, which address this vulnerability. Administrators should upgrade to one of these versions as the primary remediation. As a temporary workaround for sites that cannot immediately upgrade, disabling AJAX mode for the login page will eliminate the attack surface, since the vulnerability only affects deployments using the AJAX login override (Feedly).

A technical write-up was published by InfinitSec shortly after disclosure, detailing the vulnerability mechanics and affected configurations (InfinitSec). No significant broader media coverage or notable researcher commentary beyond initial vulnerability database entries has been identified.