Miniflux 2 CVE-2025-67713

Exploitation requires the attacker to supply a protocol-relative redirect_url (e.g. //attacker.com, empty scheme, non-empty host) to the /login endpoint and for the victim to then complete a normal, successful Miniflux login in the same flow - the redirect is only honored post-authentication. No special server configuration is needed; this is default behavior in Miniflux <= 2.2.14, so any default deployment is affected. Limiting factors that reduce real-world risk: it is useless without victim user interaction (clicking the crafted link AND logging in, matching UI:P), the impact is confined to redirecting the browser (no code execution or data read on the server), and phishing success further depends on social engineering; upgrading to 2.2.15 fully removes the condition.

This is a CWE-601 open redirect in Miniflux 2 (<= 2.2.14) that defenders should treat as a low-to-moderate priority rather than a top-tier emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N, score 5.3) shows a network-reachable, low-complexity flaw that needs victim interaction and yields only low confidentiality/integrity impact - consistent with an open redirect used to bootstrap phishing rather than to directly compromise a host. The exploitation signals are mixed but coherent: publicly available exploit code exists (a working PoC is published in the GHSA-wqv2-4wpg-8hc9 advisory), yet EPSS is very low at 0.22% (12th percentile) and the CVE is NOT in CISA KEV, indicating no confirmed active exploitation and low predicted widespread exploitation. There is no SSVC decision data in the input. The PR:N (unauthenticated) rating is accurate for the attacker - they craft a link and need no account - but note the redirect only fires after the VICTIM completes their own legitimate login, so UI:P is the real gating factor. Bottom line: a genuine, patch-worthy phishing-enablement bug, but its real-world danger is capped by the required user interaction and the low intrinsic impact of a redirect; prioritize behind any RCE/auth-bypass issues.

An attacker sends a Miniflux user a link such as http://victim-miniflux/login?redirect_url=//attacker.com; the victim, seeing a trusted Miniflux domain, logs in normally and is then silently redirected to the attacker's lookalike site, which can harvest re-entered credentials or push further social-engineering content. A working proof-of-concept is published in the vendor's GHSA advisory, and the low CVSS attack complexity (AC:L) means the only real barrier is convincing the victim to click and log in (UI:P).