CVE-2025-67713: 
NixOS vulnerability analysis and mitigation

CVE-2025-67713 is an open redirect vulnerability (CWE-601) in Miniflux 2, an open-source feed reader, affecting all versions up to and including 2.2.14. The flaw allows unauthenticated attackers to craft login URLs that redirect authenticated users to attacker-controlled external sites via protocol-relative URLs. It was published on December 10–11, 2025, and patched in version 2.2.15. The CVSS v3.1 base score is 6.1 (Medium), and the CVSS v4.0 base score is 5.3 (Medium) (Github Advisory, Miniflux Advisory).

The root cause is insufficient validation of the redirect_url query parameter in Miniflux's login handler (internal/ui/login_check.go). The vulnerable code used Go's url.Parse(...).IsAbs() to determine whether a redirect URL was safe, but protocol-relative URLs such as //attacker.com parse with an empty Scheme field, causing IsAbs() to return false — incorrectly treating them as safe relative paths. Browsers resolve //attacker.com by inheriting the current page's scheme (e.g., https://attacker.com), enabling seamless post-login redirects to external sites. The fix introduced a stricter IsRelativePath() function that additionally checks that both Host and Scheme fields are empty, explicitly rejecting scheme-relative URLs (Miniflux Advisory, Patch Commit).

Successful exploitation enables phishing attacks against authenticated Miniflux users: an attacker can craft a login URL that, after the user completes a legitimate login, silently redirects them to an attacker-controlled site for credential harvesting or malware distribution. The vulnerability has low confidentiality and integrity impact (e.g., session token or credential theft via phishing), and no availability impact. There is no risk of direct server compromise, lateral movement, or data exfiltration from the Miniflux server itself (Github Advisory).

A proof-of-concept is publicly documented in the official security advisory, demonstrating exploitation via a crafted login URL. No evidence of in-the-wild exploitation has been observed as of the time of disclosure. The vulnerability requires user interaction (a victim must click the malicious link and complete login), but no privileges are required on the attacker's side. The EPSS score is approximately 0.041% (14th percentile), indicating low near-term exploitation probability. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Miniflux Advisory).

1. Reconnaissance: Identify publicly accessible Miniflux instances running version 2.2.14 or earlier (e.g., via Shodan searching for Miniflux login pages).
2. Craft malicious URL: Construct a login URL with a protocol-relative redirect_url parameter pointing to an attacker-controlled site, e.g., https://target-miniflux.example.com/login?redirect_url=//attacker.com/phishing.
3. Deliver the link: Send the crafted URL to a target user via email, chat, or other social engineering channels, making it appear as a legitimate Miniflux login link.
4. User completes login: The victim visits the URL and completes the normal Miniflux authentication flow.
5. Post-login redirect: After successful authentication, Miniflux's login handler evaluates redirect_url=//attacker.com/phishing, determines IsAbs() is false (empty scheme), and issues an HTTP redirect to https://attacker.com/phishing.
6. Phishing objective achieved: The victim's browser navigates to the attacker's site, where credentials, session tokens, or other sensitive information may be harvested (Miniflux Advisory).

• Network: HTTP requests to the Miniflux login endpoint (/login) containing a redirect_url query parameter with a value starting with // (e.g., redirect_url=//attacker.com); outbound HTTP 302 redirects from the Miniflux server to external domains immediately following successful authentication.
• Logs: Web server or application access logs showing GET/POST requests to /login?redirect_url=//[external-domain]; log entries showing 302 responses to non-local hosts after login events.
• User Reports: Users reporting being redirected to unexpected external websites immediately after logging into Miniflux (Miniflux Advisory).

Upgrade Miniflux to version 2.2.15 or later, which introduces a stricter IsRelativePath() validation that rejects protocol-relative URLs by checking that both Host and Scheme are empty (Patch Commit). For installations that cannot be immediately patched, consider deploying a WAF rule to block requests to /login where redirect_url begins with // or contains an external hostname. Additionally, review access logs for suspicious redirect_url parameters as a detection measure (Miniflux Advisory).

The vulnerability was discovered using automated vulnerability analysis tools VulScribe and PwnML, with research supported by Japan's MITOU Advanced Program (IPA). The reporter credited is 'satoki'. No significant broader media coverage or notable community debate has been identified beyond the official advisory (Miniflux Advisory).