CVE-2022-0869
Multiple Open Redirect in nitely/spirit
Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Multiple Open Redirect in nitely/spirit
Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3.
- Record
CVE-2022-0869- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2022-1327
Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3.
- Record
EUVD-2022-1327- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5p9j-w2wx-qx4c
Open Redirect in django-spirit
django-spirit prior to version 0.12.3 is vulnerable to open redirect. In the /user/login endpoint, it doesn't check the value of the next parameter when the user is logged in and passes it directly to redirect which result to open redirect. This also affects /user/logout, /user/register, /user/login, /user/resend-activation.
- Record
GHSA-5p9j-w2wx-qx4c- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3.
- Record
CVE-2022-0869- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
Multiple Open Redirect in nitely/spirit
Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3.
- Record
CVE-2022-0869- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVGHSA-5p9j-w2wx-qx4c
Open Redirect in django-spirit
django-spirit prior to version 0.12.3 is vulnerable to open redirect. In the /user/login endpoint, it doesn't check the value of the next parameter when the user is logged in and passes it directly to redirect which result to open redirect. This also affects /user/logout, /user/register, /user/login, /user/resend-activation.
- Record
GHSA-5p9j-w2wx-qx4c- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVPYSEC-2026-631
Open Redirect in django-spirit
django-spirit prior to version 0.12.3 is vulnerable to open redirect. In the /user/login endpoint, it doesn't check the value of the next parameter when the user is logged in and passes it directly to redirect which result to open redirect. This also affects /user/logout, /user/register, /user/login, /user/resend-activation.
- Record
PYSEC-2026-631- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
django-spiritPyPI |
before 0.12.3 | 0.12.3 |
django-spiritPyPI |
before 0.12.3, plus listed versions 0.10.1.0-10.1.10.1.20.1.3 Show 29 moreShow less0.10.00.10.10.11.00.11.10.12.00.12.10.12.20.2.00.2.10.3.00.4.00.4.10.4.20.4.30.4.40.4.50.4.60.4.70.4.80.5.00.6.00.6.10.6.20.6.30.7.00.7.10.8.00.9.00.9.1 |
0.12.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | nitely/spirit 0.12.3 - Open Redirect |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-0869 is a medium vulnerability (CVSS 4.3) in Nitely Nitely/spirit, published March 6, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.64%, the 85th percentile. Fixed in django-spirit 0.12.3.
References
huntr.dev/bounties/ed335a88-f68c-4e4d-ac85-f29a51b03342
github.com/nitely/spirit/commit/8f32f89654d6c30d56e0dd167059d32146fb32ef
nvd.nist.gov/vuln/detail/CVE-2022-0869
pypi.org/project/django-spirit