Vulnerability · Published Jan 8, 2025 · Assigned by GitHub_M

CVE-2024-53995GHSL-2024-288: SickChill open redirect in login

Low 1.9

In plain English

A low-severity open redirect in sickchill from SickChill. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 4.0)1.9Low

Exploit odds (30 days)1.0%top 36.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter takes arbitrary content. Prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, an authenticated attacker may use this to redirect the user to arbitrary destinations, leading to open redirect. Commit c7128a8946c3701df95c285810eb75b2de18bf82 changes the login page to redirect to `settings.DEFAULT_PAGE` instead of to the `next` parameter.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	sickchill	no fix listed	GHSA-6gf2-ffq8-gcww
PyPI	sickchill	no fix listed	PYSEC-2026-1920

Affected products (as reported)

Vendor	Product	Versions
SickChill	sickchill	<= 2024.3.1

Weakness: CWE-601 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:P

References

https://securitylab.github.com/advisories/GHSL-2024-283_GHSL-2024-291_sickchill_sickchill/ x_refsource_CONFIRM
https://github.com/SickChill/sickchill/pull/8811 x_refsource_MISC
https://github.com/SickChill/sickchill/commit/c7128a8946c3701df95c285810eb75b2de18bf82 x_refsource_MISC
https://github.com/SickChill/sickchill/blob/846adafdfab579281353ea08a27bbb813f9a9872/sickchill/views/authentication.py#L33 x_refsource_MISC