{"id":"EUVD-2026-64137","enisaUuid":"03b1b120-f151-38ac-8bfc-7398d9de864a","description":"Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker can provide such a redirect_url value to the login flow, bypass the relative-path and host checks, and redirect a victim to an attacker-controlled external site. This issue is fixed in version 2.3.1.","datePublished":"Aug 21, 2026, 8:19:14 PM","dateUpdated":"Aug 24, 2026, 7:46:50 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/miniflux/v2/security/advisories/GHSA-m999-j542-5w3r\nhttps://github.com/miniflux/v2/pull/4362\nhttps://github.com/miniflux/v2/commit/c896bafdaa19c3f280b02b1059f84706495f1949\nhttps://github.com/miniflux/v2/releases/tag/2.3.1\n","aliases":"CVE-2026-55185\nGHSA-m999-j542-5w3r\n","assigner":"GitHub_M","epss":0.56,"enisaIdProduct":[{"id":"54a1d409-3a10-3934-b645-15fe2b6f321e","product":{"name":"v2","vendor":{"name":"miniflux"}},"product_version":"\u003c 2.3.1"}],"enisaIdVendor":[{"id":"349ea104-1e67-3a7e-b2a1-d0c8f451b332","vendor":{"name":"miniflux"}}],"enisaIdVulnerability":[{"id":"c5eaa6ec-d8af-363e-ae3e-76a872941270","vulnerability":{"id":"CVE-2026-55185","description":"Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker can provide such a redirect_url value to the login flow, bypass the relative-path and host checks, and redirect a victim to an attacker-controlled external site. This issue is fixed in version 2.3.1.","datePublished":"Aug 21, 2026, 8:19:14 PM","dateUpdated":"Aug 24, 2026, 7:46:50 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/miniflux/v2/security/advisories/GHSA-m999-j542-5w3r\nhttps://github.com/miniflux/v2/pull/4362\nhttps://github.com/miniflux/v2/commit/c896bafdaa19c3f280b02b1059f84706495f1949\nhttps://github.com/miniflux/v2/releases/tag/2.3.1\n","enisa_id":"EUVD-2026-64137\n","assigner":"GitHub_M","epss":0.56,"dataProcessed":"Nov 5, 2026, 7:16:35 AM","vulnerabilityProduct":[{"id":"d5079bdf-b2e0-35fc-983c-577e89bbc51f","product":{"name":"v2","vendor":{"name":"miniflux"}},"product_version":"\u003c 2.3.1"}],"vulnerabilityVendor":[{"id":"abf4afbc-71ef-3d78-b764-c823c49ee3ac","vendor":{"name":"miniflux"}}]}},{"id":"f2487125-fbab-371a-b716-a1d0ecdf4efd","vulnerability":{"id":"GHSA-m999-j542-5w3r","description":"Open Redirect Bypass in miniflux-v2","datePublished":"Jun 19, 2026, 9:16:13 PM","dateUpdated":"Jun 19, 2026, 9:16:13 PM","baseScore":0.0,"references":"https://github.com/miniflux/v2/security/advisories/GHSA-m999-j542-5w3r\nhttps://github.com/miniflux/v2\n","enisa_id":"EUVD-2026-64137\n","aliases":"GHSA-m999-j542-5w3r\nCVE-2026-55185\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}