CVE-2025-67713: Miniflux Feed Reader CSRF Vulnerability

CVE-2025-67713 Overview

CVE-2025-67713 is an open redirect vulnerability in Miniflux 2, an open source feed reader written in Go. Versions 2.2.14 and earlier improperly validate the redirect_url parameter during the login flow. The application treats a URL as safe when url.Parse(...).IsAbs() returns false, but protocol-relative URLs such as //attacker.example have an empty scheme and pass that check. An attacker can craft a login link that redirects authenticated users to attacker-controlled sites, enabling phishing after authentication. The issue is tracked as CWE-601: URL Redirection to Untrusted Site and is fixed in version 2.2.15.

Critical Impact
Authenticated users can be redirected to attacker-controlled domains after login, enabling credential phishing and social engineering against Miniflux users.

Affected Products

Miniflux 2 versions 2.2.14 and below
Deployments using the login flow that accepts a redirect_url parameter
Self-hosted Miniflux instances exposed to untrusted users

Discovery Timeline

2025-12-11 - CVE-2025-67713 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-67713

Vulnerability Analysis

The vulnerability resides in the login handler that processes the redirect_url query parameter. Miniflux relied on Go's net/url package to decide whether a supplied redirect target was safe. The code assumed that any URL where IsAbs() returned false was a safe, local relative path. That assumption is incorrect for protocol-relative URLs. A value like //ikotaslabs.com parses with an empty Scheme but a non-empty Host, so IsAbs() returns false while browsers still treat it as an absolute destination on the current protocol. An attacker exploits this by sending a victim a crafted login link containing a protocol-relative redirect_url. After the victim authenticates, Miniflux issues a redirect to the attacker's domain, which can present a spoofed session-expired page to harvest credentials.

Root Cause

The root cause is incomplete input validation for the redirect_url parameter. url.Parse(...).IsAbs() only checks whether a scheme is present; it does not detect scheme-relative URLs. Any check that permits an empty scheme and a non-empty host allows external redirects.

Attack Vector

Exploitation requires user interaction. The attacker sends a phishing link pointing to a legitimate Miniflux instance with a malicious redirect_url query parameter. The victim authenticates on the trusted host, and the server-side redirect then sends the browser to the attacker's site.

// Security patch from internal/urllib/url.go (Miniflux 2.2.15)
// IsRelativePath returns true if the link is a relative path.
func IsRelativePath(link string) bool {
    if link == "" {
        return false
    }
    if parsedURL, err := url.Parse(link); err == nil {
        // Only allow relative paths (not scheme-relative URLs like //example.org)
        // and ensure the URL doesn't have a host component
        if !parsedURL.IsAbs() && parsedURL.Host == "" && parsedURL.Scheme == "" {
            return true
        }
    }
    return false
}

Source: Miniflux commit 76df99f. The patch introduces IsRelativePath, which requires both an empty Scheme and empty Host, rejecting protocol-relative payloads.

Detection Methods for CVE-2025-67713

Indicators of Compromise

Login requests to /login or the login-check endpoint containing a redirect_url parameter beginning with // or a backslash sequence such as /\
HTTP Location response headers from Miniflux pointing to external hosts after successful authentication
Referrer logs on external domains showing traffic originating from /login paths on Miniflux instances

Detection Strategies

Inspect web server and reverse proxy logs for redirect_url values whose decoded form does not start with a single / followed by an alphanumeric character
Alert when Miniflux returns a 302 with a Location header whose host differs from the Miniflux service host
Correlate outbound user browser navigations from Miniflux sessions with domains not on an approved allowlist

Monitoring Recommendations

Enable verbose access logging on the Miniflux reverse proxy and retain query strings for forensic review
Baseline the legitimate set of redirect_url values and flag deviations
Monitor version metadata exposed by Miniflux to identify instances still running 2.2.14 or earlier

How to Mitigate CVE-2025-67713

Immediate Actions Required

Upgrade all Miniflux 2 deployments to version 2.2.15 or later
Audit reverse proxy and application logs for prior use of malicious redirect_url values and notify affected users
Invalidate active sessions if evidence of exploitation exists and require password resets for users who followed suspicious login links

Patch Information

The fix is delivered in Miniflux 2.2.15. The patch replaces the IsAbs()-only check with the new IsRelativePath helper that rejects any URL containing a scheme or host. Full remediation details are available in the GitHub Security Advisory GHSA-wqv2-4wpg-8hc9 and the upstream commit 76df99f.

Workarounds

Strip the redirect_url query parameter at the reverse proxy for requests to the login endpoint until the upgrade is applied
Enforce a Content Security Policy and referrer policies that limit outbound navigation from the Miniflux origin
Educate users to authenticate directly from bookmarked URLs rather than following emailed login links

bash

# Example NGINX rule to strip redirect_url from login requests as a temporary control
location = /login {
    if ($arg_redirect_url) {
        rewrite ^ /login? permanent;
    }
    proxy_pass http://miniflux_upstream;
}