A flaw in the domain validation logic of the /redirect-proxy endpoint lets an attacker craft a URL that bypasses the whitelist by appending a malicious domain to a trusted suffix. The bypass occurs because the Regular Expression anchoring is insufficient, allowing the attacker to redirect users to arbitrary external sites. This can be exploited to facilitate phishing or drive traffic to malicious domains, compromising user trust and potentially enabling social engineering attacks. The weakness is classified as CWE‑601, an open redirect vulnerability.

This issue affects the open-source workspace platform AffiNE from the toeverything vendor. Versions prior to 0.26.0 are vulnerable; the fix is included in 0.26.0 and later releases. Systems using the system’s redirect-proxy feature are at risk.

The CVSS score of 6.9 reflects moderate severity. However, the EPSS score of less than 1% indicates that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. The typical attack vector would be through a crafted URL, so users or attackers could supply malicious links that appear legitimate. While the risk to system integrity is low, the impact on user trust and potential for phishing remains significant.