CVE-2026-25477: AFFiNE Open Redirect Vulnerability

CVE-2026-25477 Overview

CVE-2026-25477 is an Open Redirect vulnerability discovered in AFFiNE, an open-source, all-in-one workspace and operating system application. The vulnerability exists in the /redirect-proxy endpoint where an improperly anchored Regular Expression in the domain validation logic allows attackers to bypass the whitelist by crafting malicious domains that end with a trusted string. This flaw enables attackers to redirect users to malicious websites, potentially facilitating phishing attacks or credential theft.

Critical Impact

Attackers can bypass domain validation to redirect users to malicious sites, enabling phishing campaigns, credential harvesting, and social engineering attacks against AFFiNE users.

Affected Products

• AFFiNE versions prior to 0.26.0

Discovery Timeline

• 2026-03-02 - CVE CVE-2026-25477 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-25477

Vulnerability Analysis

This vulnerability is classified under CWE-601 (URL Redirection to Untrusted Site, also known as Open Redirect). The core issue stems from a flawed domain validation mechanism within the /redirect-proxy endpoint. The Regular Expression used to validate redirect URLs is improperly anchored, meaning it does not correctly enforce that the entire domain must match a trusted whitelist entry.

Instead of verifying that the domain exactly matches an allowed value, the vulnerable regex only checks if the domain string ends with a trusted pattern. This allows an attacker to craft a malicious domain such as malicious-trusted.com or attacker-affine.pro that passes validation because it terminates with characters matching the expected pattern.

Root Cause

The root cause is an improperly anchored Regular Expression in the domain validation logic. When regex patterns lack proper start (^) and end ($) anchors or use insufficiently specific matching criteria, they can inadvertently match unintended input strings. In this case, the regex was designed to whitelist trusted domains but only validated the suffix of the domain string rather than the complete domain name.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker constructs a malicious URL targeting the /redirect-proxy endpoint with a specially crafted domain parameter. When a victim clicks this link (often delivered via phishing email, social media, or embedded in a webpage), the AFFiNE application validates the domain against its whitelist. Due to the regex flaw, the malicious domain passes validation, and the user is silently redirected to the attacker-controlled site.

The malicious domain leverages the suffix-matching vulnerability by appending a trusted domain string to the end of an attacker-controlled domain. For example, if affine.pro is whitelisted, an attacker could register malicious-affine.pro or use a subdomain pattern that exploits the improper anchoring.

Detection Methods for CVE-2026-25477

Indicators of Compromise

• Unexpected outbound redirects from the /redirect-proxy endpoint to external domains not on the expected whitelist
• User reports of being redirected to suspicious or unfamiliar websites after clicking AFFiNE links
• Web server logs showing requests to /redirect-proxy with domain parameters containing unusual suffixes or hyphenated variations of trusted domains

Detection Strategies

• Monitor web application logs for requests to the /redirect-proxy endpoint with unusual or suspicious domain parameters
• Implement URL inspection rules that flag redirect requests where the target domain contains trusted domain names as suffixes rather than exact matches
• Deploy web application firewall (WAF) rules to detect and block potential open redirect exploitation attempts

Monitoring Recommendations

• Enable detailed logging for all redirect endpoint activity, capturing full URL parameters and referrer information
• Set up alerts for high volumes of redirect requests or redirects to newly registered or low-reputation domains
• Regularly audit application logs for patterns indicative of open redirect abuse, such as domains with hyphenated trusted suffixes

How to Mitigate CVE-2026-25477

Immediate Actions Required

• Upgrade AFFiNE to version 0.26.0 or later immediately to receive the security patch
• Review application logs for any historical exploitation attempts targeting the /redirect-proxy endpoint
• Notify users who may have been affected by potential phishing campaigns leveraging this vulnerability

Patch Information

The vulnerability has been patched in AFFiNE version 0.26.0. Users should update to this version or later to remediate the vulnerability. For detailed information about the fix, refer to the GitHub Security Advisory.

Workarounds

• If immediate patching is not possible, consider implementing a reverse proxy or WAF rule to strictly validate redirect URLs at the network edge
• Temporarily disable the /redirect-proxy endpoint if it is not critical to operations until the patch can be applied
• Implement Content Security Policy (CSP) headers to restrict navigation to known-trusted domains

# Example: Nginx configuration to block suspicious redirect patterns
# Add to your server block as a temporary workaround

location /redirect-proxy {
    # Block requests with potentially malicious domain suffixes
    if ($arg_url ~* "[-.]affine\.pro$") {
        return 403;
    }
    # Allow only exact trusted domains (adjust as needed)
    # Consult AFFiNE documentation for proper configuration
}