CVE-2025-67713

Name of the Vulnerable Software and Affected Versions Miniflux versions 2.2.14 and below

Description Miniflux is an open source feed reader susceptible to an open redirect issue. Specifically, versions 2.2.14 and earlier incorrectly handle the redirect url parameter when url.Parse(...).IsAbs() returns false, creating a potential for phishing attacks after a user logs in. Protocol-relative URLs, such as //ikotaslabs.com, bypass the safety check due to their empty scheme, enabling redirects to attacker-controlled websites. The issue is resolved in version 2.2.15. The vulnerable parameter is redirect url.

Recommendations Update to version 2.2.15 or later.