CVE-2026-55185
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Miniflux 2 prior to 2.3.1 accepts redirect targets containing backslashes, which browsers normalize to forward slashes. An unauthenticated attacker can exploit this in the login flow to redirect a victim to an attacker-controlled external site, bypassing relative-path and host checks.
Risk Assessment
Risk of phishing and redirecting users to malicious sites, potentially leading to credential theft or malware infection.
Recommendation
Update Miniflux to version 2.3.1 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Miniflux
See all- CVE-2026-108735Medium
Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can point proxy_url at loopback or internal hosts, bypassing FETCHER_ALLOW_PRIVATE_NETWORKS checks to probe internal ports and send proxy-style requests to internal services.
- CVE-2025-67713Medium
Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites. This issue is fixed in version 2.2.15.
Original NVD description (English source)
Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker can provide such a redirect_url value to the login flow, bypass the relative-path and host checks, and redirect a victim to an attacker-controlled external site. This issue is fixed in version 2.3.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS