Executive brief
Miniflux, a minimalist RSS feed reader, is vulnerable to an open redirect flaw. Attackers can trick users into clicking a link that appears to belong to the trusted Miniflux application but instead redirects them to a malicious external website. This can be used in phishing campaigns to steal user credentials or deliver malware by exploiting the user's trust in the original domain.
Technical details
An open redirect vulnerability exists in Miniflux v2 due to insufficient validation in the IsRelativePath function. While the application attempts to block absolute URLs and protocol-relative paths (e.g., //example.com), it fails to account for backslash characters that browsers automatically normalize. An attacker can use a payload like '/\example.com' to bypass the relative path check. The backend treats this as a relative path because it lacks a host or scheme, but modern browsers interpret the backslash as a forward slash, resulting in a redirection to an external domain. This can be exploited via the redirect_url parameter during login or other navigation events. The issue is fixed in version 2.3.1.
Affected products
- miniflux miniflux/v2 <= 2.3.0
Timeline
- 2026-06-18: disclosed
- 2026-06-19: advisory
- 2026-06-19: patched: Fixed in version 2.3.1