Back to Database
Status published
Medium
CVE-2025-67713
Miniflux 2 has an Open Redirect via protocol-relative `redirect_url`
Vulnerability Description
Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites. This issue is fixed in version 2.2.15.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-67713
Credits & Attribution
No credits recorded in the NVD database.
References
More from miniflux
View All →CVE-2025-31483
Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configuration
Medium
4.8
CVE-2023-27592
Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler
Medium
4.8
CVE-2023-27591
Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
High
7.5
Affected Vendor
miniflux
View all reports →Affected Software
v2
Vulnerable Versions:
< 2.2.15
Timeline
Official Publish:
December 11th, 2025
Last Modified:
December 11th, 2025
Added to House:
July 22nd, 2026