CVE-2026-55185 Miniflux 2: Open Redirect Bypass
An attacker can bypass redirect checks in Miniflux 2 to redirect victims to malicious external sites via crafted login URLs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-55185?
CVE-2026-55185 is a medium-severity vulnerability in miniflux v2, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path characters. Browser backslash normalization converts them to forward slashes. An unauthenticated attacker can provide such a redirect_url value to the login flow, bypass the relative-path and host checks, and redirect a victim to an attacker-controlled external site. This issue is fixed in version 2.3.1.
Weakness: CWE-601
Which versions are affected by CVE-2026-55185?
4 open source packages ship an affected version, including miniflux.app/v2 and miniflux.app.
| Package | Affected | Fixed in |
|---|---|---|
miniflux.app/v2 Go | All versions | 2.3.1 |
miniflux.app/v2 Go | All versions | 2.3.1 |
miniflux.app/v2 Go | All versions | 2.3.1 |
miniflux.app Go | All versions | None |
How do I fix CVE-2026-55185?
Upgrade miniflux.app/v2 to 2.3.1 or later.
Is CVE-2026-55185 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55185 exists.
Sources
Also known as DEBIAN-CVE-2026-55185, GHSA-m999-j542-5w3r, GO-2026-5500, UBUNTU-CVE-2026-55185.