CVE-2026-55185: Miniflux 2 Feed Reader Auth Bypass Vulnerability

CVE-2026-55185 Overview

Miniflux 2, an open source feed reader, contains an open redirect vulnerability in versions prior to 2.3.1. The IsRelativePath function in internal/urllib/url.go accepts redirect targets containing backslash characters because Go's url.Parse treats them as ordinary path characters. Browsers normalize backslashes to forward slashes, allowing a crafted redirect_url value in the login flow to bypass relative-path and host checks. An unauthenticated attacker can redirect a victim to an attacker-controlled external site. The issue is fixed in Miniflux 2.3.1 and is classified as URL Redirection to Untrusted Site [CWE-601].

Critical Impact
Unauthenticated attackers can craft phishing links that appear to originate from a trusted Miniflux instance and redirect victims to attacker-controlled sites after authentication.

Affected Products

Miniflux 2 versions prior to 2.3.1
internal/urllib/url.go in the Miniflux 2 repository
Miniflux 2 login flow accepting the redirect_url parameter

Discovery Timeline

2026-08-21 - CVE-2026-55185 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-55185

Vulnerability Analysis

The IsRelativePath function is intended to ensure that user-supplied redirect targets remain within the Miniflux application. It rejects scheme-relative URLs such as //example.org and any input containing a host component. The check relies on Go's standard net/url package to parse the candidate target.

Go's url.Parse treats the backslash character as an ordinary path character rather than a separator. A value like /\attacker.com parses as a relative path with no host, satisfying the validation logic. Web browsers, however, normalize backslashes to forward slashes during URL resolution. The same value is interpreted as //attacker.com, a protocol-relative URL that navigates to an external origin.

An attacker sends a victim a link to the Miniflux login endpoint with redirect_url=/\attacker.com. After successful authentication, the application issues a redirect that the browser resolves to the attacker's domain. This enables phishing pages that inherit the trust of the legitimate Miniflux hostname.

Root Cause

The root cause is a parser differential between Go's URL parser and browser URL normalization. The IsRelativePath helper did not account for backslashes, which are semantically distinct in Go's parser but treated as path separators by browsers.

Attack Vector

Exploitation requires network access to the Miniflux login endpoint and user interaction from the victim. No authentication or privileges are required on the attacker side. The attacker delivers a crafted URL, typically via email or messaging, and the victim's browser performs the redirect after login.

 	if link == "" {
 		return false
 	}
+
+	// Reject backslashes: Go's url.Parse treats them as ordinary path
+	// characters, but browsers normalize them to forward slashes, so a target
+	// like "/\evil.com" would parse as relative here yet redirect to
+	// //evil.com in the browser (open redirect).
+	if strings.Contains(link, "\\") {
+		return false
+	}
+
 	if parsedURL, err := url.Parse(link); err == nil {
 		// Only allow relative paths (not scheme-relative URLs like //example.org)
 		// and ensure the URL doesn't have a host component

Source: GitHub Commit c896bafd. This patch rejects any candidate redirect target containing a backslash before further parsing.

Detection Methods for CVE-2026-55185

Indicators of Compromise

HTTP requests to the Miniflux login endpoint containing a redirect_url parameter with URL-encoded backslashes (%5C) or literal \ characters.
Referrer logs showing outbound navigation from the Miniflux instance to unexpected external domains immediately after /login responses.
Access log entries where the redirect_url value begins with /\ or \ followed by an external hostname.

Detection Strategies

Parse web server and reverse-proxy access logs for redirect_url query values containing %5C, \, or the sequence /\.
Correlate login-flow redirects with the destination host, flagging any resolved target that does not match the Miniflux instance's own hostname.
Add web application firewall (WAF) rules that block requests to /login when the redirect_url parameter contains backslash characters.

Monitoring Recommendations

Alert on repeated login requests from a single source with varying redirect_url payloads, which suggests probing for open redirect behavior.
Track outbound HTTP referrers from the Miniflux origin and baseline expected internal paths.
Monitor Miniflux release channels and package feeds to confirm the deployed version is 2.3.1 or later.

How to Mitigate CVE-2026-55185

Immediate Actions Required

Upgrade Miniflux 2 to version 2.3.1 or later, which contains the fix in internal/urllib/url.go.
Audit login and redirect flows for any additional callers of IsRelativePath that may need input canonicalization.
Communicate the phishing risk to users so they recognize unexpected post-login redirects to external domains.

Patch Information

The fix is included in Miniflux Release 2.3.1 and applied via Pull Request #4362. The corresponding advisory is GHSA-m999-j542-5w3r. The patch rejects any relative path candidate containing a backslash before further URL parsing.

Workarounds

Deploy a reverse-proxy or WAF rule that drops requests to the Miniflux login endpoint when the redirect_url parameter contains \ or %5C.
Restrict the redirect_url parameter server-side to an allowlist of known internal paths until the upgrade is deployed.
Disable or remove the redirect_url query parameter handling in reverse-proxy configuration if upgrades cannot be applied immediately.

bash

# Example nginx rule to block backslash characters in redirect_url
if ($arg_redirect_url ~* "(\\|%5C)") {
    return 400;
}