CVE-2025-67713: Miniflux 2 has an Open Redirect via protocol-relative `redirect_url`
Vulnerability summary
CVE-2025-67713 is a medium (CVSS 6.1) Open Redirect vulnerability in miniflux_project miniflux. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.9% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 11-12-2025PublishedVulnerability first disclosed.
- 11-12-2025Last modifiedVulnerability information updated.
Description
Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites. This issue is fixed in version 2.2.15.
CVSS metrics
7 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- OSV · GoEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- NVDNIST5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
12%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.22% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundV2
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian1 product
- miniflux< 2.2.16-1
Go1 product
- miniflux.appAll versions (No fix recorded)
Miniflux1 product
- v2< 2.2.15
Miniflux_project1 product
- miniflux< 2.2.15
Miniflux.app1 product
- v2< 2.2.15
Ubuntu1 product
- minifluxAll versions (No fix recorded)
6 vendors · 6 products
References
7 links- github.com/miniflux/v2/security/advisories/GHSA-wqv2-4wpg-8hc9X Refsource CONFIRMREPORTWEBAdvisoryExploitVendor Advisory
- github.com/miniflux/v2/commit/76df99f3a3db234cf6b312be5e771485213d03c7X Refsource MISCREPORTWEBPatch
- github.com/miniflux/v2PACKAGE