# CVE-2025-67713: GO-2025-4226 - Miniflux has an Open Redirect via protocol-relative redirect_url in miniflux.app

Source: https://junglewise.ai/threats/cve-2025-67713-miniflux-has-an-open-redirect-via-protocol-relative-redirect-url  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-11  
License: CC BY 4.0 with a link back

CVE-2025-67713 · Severity: medium · CVSS 6.1 · Published 2025-12-11

Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites. This issue is fixed in version 2.2.15.

Technologies: [miniflux.app (Go)](https://junglewise.ai/threats/technologies/miniflux-app), [miniflux.app/v2 (Go)](https://junglewise.ai/threats/technologies/miniflux-app-v2). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2025-67713 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-67713 being exploited in the wild.

**How severe is CVE-2025-67713?** Medium severity, with a CVSS score of 6.1, published 11 December 2025.

**Which products and versions are affected?** miniflux.app (Go) SEMVER:introduced=0; miniflux.app/v2 (Go) SEMVER:introduced=0,fixed=2.2.15.

**Is there a fix for CVE-2025-67713?** Yes. miniflux.app/v2 (Go): upgrade to 2.2.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-67713?** Check whether you run miniflux.app (Go), miniflux.app/v2 (Go) or Miniflux Project Miniflux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- miniflux.app/v2 (Go): upgrade to 2.2.15 or later

  ```sh
  go get miniflux.app/v2@v2.2.15
  ```


## Affected products

- miniflux.app (Go) SEMVER:introduced=0
- miniflux.app/v2 (Go) SEMVER:introduced=0,fixed=2.2.15
- Miniflux Project Miniflux

## Identifiers

- CVE-2025-67713
- GHSA-wqv2-4wpg-8hc9
- GO-2025-4226

## Related threats

- [Miniflux miniflux-v2 open redirect bypass](https://junglewise.ai/threats/cve-2026-55185-miniflux-miniflux-v2-open-redirect-bypass)
- [GO-2026-4287 - Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources in miniflux.app](https://junglewise.ai/threats/cve-2026-21885-miniflux-media-proxy-ssrf-via-proxy-endpoint-allows-access-to)
- [Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration](https://junglewise.ai/threats/cve-2025-31483-miniflux-media-proxy-vulnerable-to-stored-cross-site-scripting)
- [Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler](https://junglewise.ai/threats/cve-2023-27592-stored-xss-in-miniflux-when-opening-a-broken-image-due-to)
- [Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics](https://junglewise.ai/threats/cve-2023-27591-unauthenticated-miniflux-user-can-bypass-allowed-networks-check)