Executive brief
Speakr, a self-hosted application for transcribing audio recordings, contains a security flaw that allows for "open redirects." An attacker can create a specially crafted link that appears to belong to a trusted Speakr installation but actually sends the user to a malicious external website after they log in. This can be used in phishing campaigns to trick users into providing credentials or downloading malware on a site they believe is legitimate.
Technical details
An open redirect vulnerability exists in Speakr due to a parser mismatch between the validation logic and the redirection controller. The `is_safe_url()` helper validated post-login redirect targets by applying `urljoin(request.host_url, target)` before parsing, which caused scheme-relative inputs (e.g., `////evil.com`) to resolve as same-host URLs during the safety check. However, the controller passed the raw, unjoined target to the `redirect()` function, causing the browser to interpret the `Location` header as a network-path-relative redirect to an external host. This allows an unauthenticated remote attacker to facilitate phishing attacks by redirecting users to arbitrary domains. The issue is fixed in version 0.8.20-alpha by implementing a local-path allowlist and rejecting scheme-relative URLs.
Affected products
- murtaza-nasir Speakr < 0.8.20-alpha
Timeline
- 2026-05-09: advisory: GitHub security advisory published by maintainer
- 2026-05-28: disclosed: CVE published to NVD dataset