EUVD-2026-32967Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionGitHub Advisory
Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.20-alpha, the is_safe_url() helper used to validate post-login redirect targets applied urljoin(request.host_url, target) before parsing, while the controller passed the raw target to redirect(). A scheme-relative input such as ////evil.com resolved to a same-host URL during validation but was emitted verbatim in the Location header, where the browser interpreted it as a network-path-relative redirect to an attacker-controlled host. This vulnerability is fixed in 0.8.20-alpha.
AnalysisAI
Open redirect in Speakr's post-login redirect handler allows unauthenticated remote attackers to silently redirect authenticated users to attacker-controlled hosts via scheme-relative URLs such as '////evil.com'. The flaw stems from a logic split between the validation function - which normalizes the redirect target using urljoin() before checking safety - and the controller, which passes the raw, un-normalized target to redirect(), emitting it verbatim in the HTTP Location header. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and phishing utility make this a credible risk for self-hosted deployments.
Technical ContextAI
Speakr is a self-hosted web application for audio transcription, identified by CPE cpe:2.3:a:murtaza-nasir:speakr:*:*:*:*:*:*:*:*. The root cause is CWE-601 (URL Redirection to Untrusted Site), arising from a validation/execution desync in the is_safe_url() helper. The helper applies Python's urljoin(request.host_url, target) to normalize the candidate redirect URL before evaluating whether it points to the same host - a common defensive pattern. However, urljoin's handling of scheme-relative paths with multiple leading slashes (e.g., '////evil.com') resolves them against the base host during normalization, making them appear safe. Because the controller then calls redirect() on the original, unmodified target string rather than the normalized form, the raw '////evil.com' is written into the Location response header. RFC 3986-compliant browsers interpret a path beginning with '//' as a network-path reference and navigate to the authority component - in this case, evil.com - completing the redirect to an attacker-controlled host.
RemediationAI
Upgrade Speakr to version 0.8.20-alpha or later, which resolves the validation-execution desync by ensuring the controller uses the normalized URL rather than the raw input when constructing redirect responses. The fix details and release are documented in the GitHub Security Advisory at https://github.com/murtaza-nasir/speakr/security/advisories/GHSA-5cpp-mqgh-4c38. For deployments where immediate upgrade is not feasible, a compensating control is to reject any redirect target that contains sequences of consecutive forward slashes (e.g., '//') at the server level or via a WAF rule targeting the redirect parameter - this trades off some edge-case redirect flexibility for elimination of the scheme-relative bypass. An alternative is to strip the target parameter entirely and enforce a fixed post-login destination, removing the redirect feature until patching is complete; this eliminates the attack surface at the cost of user convenience for deep-link flows.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today