{"id":"EUVD-2025-202448","enisaUuid":"fbffea57-9a1b-3894-be36-fee004e88458","description":"Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites. This issue is fixed in version 2.2.15.","datePublished":"Dec 11, 2025, 12:17:00 AM","dateUpdated":"Dec 11, 2025, 6:52:30 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/miniflux/v2/security/advisories/GHSA-wqv2-4wpg-8hc9\nhttps://github.com/miniflux/v2/commit/76df99f3a3db234cf6b312be5e771485213d03c7\n","aliases":"CVE-2025-67713\nGHSA-wqv2-4wpg-8hc9\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"2f41bbd4-2036-3c7a-8ad3-8474dab57c70","product":{"name":"v2","vendor":{"name":"miniflux"}},"product_version":"\u003c 2.2.15"}],"enisaIdVendor":[{"id":"68794f31-613a-32af-8bc0-bfaf65872137","vendor":{"name":"miniflux"}}],"enisaIdVulnerability":[{"id":"916e3dd6-e25d-38d0-869c-b35a7276e7e6","vulnerability":{"id":"CVE-2025-67713","description":"Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites. This issue is fixed in version 2.2.15.","datePublished":"Dec 11, 2025, 12:17:00 AM","dateUpdated":"Dec 11, 2025, 6:52:30 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/miniflux/v2/security/advisories/GHSA-wqv2-4wpg-8hc9\nhttps://github.com/miniflux/v2/commit/76df99f3a3db234cf6b312be5e771485213d03c7\n","enisa_id":"EUVD-2025-202448\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Nov 4, 2026, 7:20:05 AM","vulnerabilityProduct":[{"id":"203a701d-b26f-3777-91cf-96b6ef88dae8","product":{"name":"v2","vendor":{"name":"miniflux"}},"product_version":"\u003c 2.2.15"}],"vulnerabilityVendor":[{"id":"bf3e07d9-d0c5-3f46-8ce7-168d789ed37a","vendor":{"name":"miniflux"}}]}},{"id":"a85df389-4134-3764-b6b7-2876c360f4a2","vulnerability":{"id":"GHSA-wqv2-4wpg-8hc9","description":"Miniflux has an Open Redirect via protocol-relative redirect_url","datePublished":"Dec 10, 2025, 5:18:37 PM","dateUpdated":"Feb 2, 2026, 4:29:11 PM","baseScore":0.0,"references":"https://github.com/miniflux/v2/security/advisories/GHSA-wqv2-4wpg-8hc9\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-67713\nhttps://github.com/miniflux/v2/commit/76df99f3a3db234cf6b312be5e771485213d03c7\nhttps://github.com/miniflux/v2\n","enisa_id":"EUVD-2025-202448\n","aliases":"CVE-2025-67713\nGHSA-wqv2-4wpg-8hc9\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}