Speakr
Monthly
Open redirect in Speakr's post-login redirect handler allows unauthenticated remote attackers to silently redirect authenticated users to attacker-controlled hosts via scheme-relative URLs such as '////evil.com'. The flaw stems from a logic split between the validation function - which normalizes the redirect target using urljoin() before checking safety - and the controller, which passes the raw, un-normalized target to redirect(), emitting it verbatim in the HTTP Location header. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and phishing utility make this a credible risk for self-hosted deployments.
Open redirect in Speakr's post-login redirect handler allows unauthenticated remote attackers to silently redirect authenticated users to attacker-controlled hosts via scheme-relative URLs such as '////evil.com'. The flaw stems from a logic split between the validation function - which normalizes the redirect target using urljoin() before checking safety - and the controller, which passes the raw, un-normalized target to redirect(), emitting it verbatim in the HTTP Location header. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and phishing utility make this a credible risk for self-hosted deployments.