CVE-2025-67713
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites. This issue is fixed in version 2.2.15.
Risk Assessment
An attacker can redirect a user after login to a malicious site, potentially leading to credential theft or other phishing attacks. This can compromise user account security.
Recommendation
Update Miniflux to version 2.2.15 or later, which fixes this vulnerability. If an update is not possible, consider restricting redirect trust or implementing additional controls.
Other vulnerabilities in Miniflux
See all- CVE-2026-108735Medium
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can point proxy_url at loopback or internal hosts, bypassing FETCHER_ALLOW_PRIVATE_NETWORKS checks to probe internal ports and send proxy-style requests to internal services.
- CVE-2026-55185Medium
Miniflux 2 prior to 2.3.1 accepts redirect targets containing backslashes, which browsers normalize to forward slashes. An unauthenticated attacker can exploit this in the login flow to redirect a victim to an attacker-controlled external site, bypassing relative-path and host checks.
Original NVD description (English source)
Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites. This issue is fixed in version 2.2.15.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS