What’s Vulnerable › Vulnerabilities

CVE-2026-55185: Miniflux 2: Open Redirect Bypass

• Severity: medium (CVSS 5.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-21 · updated 2026-10-12
• Weakness: CWE-601

Description

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker can provide such a redirect_url value to the login flow, bypass the relative-path and host checks, and redirect a victim to an attacker-controlled external site. This issue is fixed in version 2.3.1.

Affected products

• miniflux v2: before 2.3.1

References

• https://github.com/miniflux/v2/commit/c896bafdaa19c3f280b02b1059f84706495f1949
• https://github.com/miniflux/v2/pull/4362
• https://github.com/miniflux/v2/releases/tag/2.3.1
• https://github.com/miniflux/v2/security/advisories/GHSA-m999-j542-5w3r
• https://github.com/miniflux/v2/security/advisories/GHSA-m999-j542-5w3r

Get alerted when CVE-2026-55185 or the next vulnerability affects your stack