CVE-2025-67713: Miniflux has an Open Redirect via protocol-relative redirect_url

December 10, 2025 (updated February 2, 2026)

redirect_url is treated as safe when url.Parse(...).IsAbs() is false. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites.

References

github.com/advisories/GHSA-wqv2-4wpg-8hc9
github.com/miniflux/v2
github.com/miniflux/v2/commit/76df99f3a3db234cf6b312be5e771485213d03c7
github.com/miniflux/v2/security/advisories/GHSA-wqv2-4wpg-8hc9
nvd.nist.gov/vuln/detail/CVE-2025-67713

Code Behaviors & Features

Detect and mitigate CVE-2025-67713 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →