Miniflux 2 has a CWE‑601 open redirect flaw that allows unauthenticated users to supply a redirect_url parameter during login that includes backslashes. Go URL parsing treats backslashes as part of the path, but browser normalization converts them to forward slashes, thereby bypassing the relative‑path and host checks built into the authentication flow. This flaw lets an attacker redirect victims to an attacker‑controlled website, facilitating phishing or social‑engineering attacks. The primary impact is a reliable open redirect that can be exploited without authentication.

The issue exists in Miniflux community editions v2 of the open source feed reader, affecting all releases prior to 2.3.1. Version 2.3.1 and later contain the fix that properly rejects backslash‑containing redirect targets.

The CVSS score of 5.1 indicates moderate severity. No EPSS data is available and the vulnerability is not listed in CISA KEV, suggesting it is not currently widely exploited. An attacker can trigger the redirect by issuing a crafted login request, so the exploitation requires only unauthenticated access to the login endpoint and a target URL containing backslashes. The attack vector is inferred from the description of the redirect flow and may be used for phishing campaigns, but no advanced privileges or internal network traversal are necessary.