CVE-2025-67713: Miniflux 2 has an Open Redirect via protocol-relative `redirect_url`
Summary redirecturl is treated as safe when url.Parse(...).IsAbs() is false. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites.
Details - url.Parse("//ikotaslabs.com") => empty Scheme, Host="ikotaslabs.com". - IsAbs() returns false for //ikotaslabs.com, so the code treats it as allowed. - Browser resolves //ikotaslabs.com to current-origin scheme (e.g. https://ikotaslabs.com), enabling phishing flows after login.
PoC 1. Send or visit: http://localhost/login?redirecturl=//ikotaslabs.com 2. Complete normal login flow. 3. After login the app redirects to https://ikotaslabs.com (or http:// depending on origin).
Acknowledgements This vulnerability was discovered using the automated vulnerability analysis tools VulScribe and PwnML. The research and tool development were conducted with support from the MITOU Advanced Program (未踏アドバンスト事業), implemented by the Information-technology Promotion Agency (IPA), Japan.
Other sources
Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirecturl as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites. This issue is fixed in version 2.2.15.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/miniflux.app/v2to a version that resolves this vulnerability.Fixed in 2.2.15 - Upgrade
Upgrade
Miniflux 2to a version that resolves this vulnerability.Fixed in 2.2.15
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67713?
CVE-2025-67713 is classified as a high-severity vulnerability due to its potential for exploitation through open redirect attacks.
How do I fix CVE-2025-67713?
To fix CVE-2025-67713, upgrade to version 2.2.15 of the affected software, miniflux.app/v2.
What are the potential impacts of CVE-2025-67713?
The impact of CVE-2025-67713 includes the risk of phishing attacks through unauthorized post-login redirects to malicious sites.
Which versions are affected by CVE-2025-67713?
CVE-2025-67713 affects all versions of miniflux.app/v2 prior to 2.2.15.
What is the root cause of CVE-2025-67713?
The root cause of CVE-2025-67713 is the unsafe handling of protocol-relative URLs, which allows bypassing safety checks.