CyberRota Analysis
AI-GeneratedMiniflux 2 versions prior to 2.3.1 are vulnerable to an issue in the URL parsing mechanism that allows unauthenticated attackers to exploit backslashes in redirect URLs, bypassing security checks. This can lead to open redirect vulnerabilities, potentially redirecting users to malicious external sites. Users and administrators of Miniflux 2 should prioritize upgrading to version 2.3.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker can provide such a redirect_url value to the login flow, bypass the relative-path and host checks, and redirect a victim to an attacker-controlled external site. This issue is fixed in version 2.3.1.