PYSEC-2026-631

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/django-spirit/PYSEC-2026-631.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-631

Aliases

Published

2026-07-02T14:13:15Z

Modified

2026-07-06T08:00:11Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Open Redirect in django-spirit

Details

django-spirit prior to version 0.12.3 is vulnerable to open redirect. In the /user/login endpoint, it doesn't check the value of the next parameter when the user is logged in and passes it directly to redirect which result to open redirect. This also affects /user/logout, /user/register, /user/login, /user/resend-activation.

References

Affected packages

PyPI / django-spirit

Package

Name: django-spirit; View open source insights on deps.dev
Purl: pkg:pypi/django-spirit

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.12.3

Affected versions

0.*

0.1

0.1.0-1

0.1.1

0.1.2

0.1.3

0.2.0

0.2.1

0.3.0

0.4.0

0.4.1

0.4.2

0.4.3

0.4.4

0.4.5

0.4.6

0.4.7

0.4.8

0.5.0

0.6.0

0.6.1

0.6.2

0.6.3

0.7.0

0.7.1

0.8.0

0.9.0

0.9.1

0.10.0

0.10.1

0.11.0

0.11.1

0.12.0

0.12.1

0.12.2

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/django-spirit/PYSEC-2026-631.yaml"