CVE-2026-45307

Vulnerability

Speakr, a personal self-hosted web application for transcribing audio, contained an open redirect vulnerability in versions prior to 0.8.20-alpha. The is_safe_url() helper used to validate post-login redirect targets applied urljoin(request.host_url, target) before parsing, while the controller passed the raw target to redirect(). A scheme-relative input such as ////evil.com resolved to a same-host URL during validation but was emitted verbatim in the Location header, where the browser interpreted it as a network-path-relative redirect to an attacker-controlled host [1].

Exploitation

An attacker can craft a Speakr-hosted login URL with a malicious next parameter. For example, requesting GET /login?next=%2F%2F%2F%2Fevil.com causes is_safe_url('////evil.com') to return True, and the response sets Location: ////evil.com, which browsers follow to https://evil.com/. No authentication or special privileges are required; the attacker only needs to lure an authenticated user to the crafted link [1].

Impact

The attacker gains the ability to redirect authenticated users to an arbitrary external site after sign-in. This enables phishing chains that begin from a trusted Speakr deployment, potentially leading to credential theft or other malicious outcomes [1].

Mitigation

The vulnerability is fixed in version 0.8.20-alpha. The fix rewrites is_safe_url() to validate the raw target against a local-path allowlist: leading / is required; scheme-relative URLs (//, \), backslashes, control characters, and any value with a scheme or netloc are rejected. The duplicate copy in src/api/auth.py was removed, and regression tests were added. Users on 0.8.19-alpha or earlier who cannot upgrade immediately can front Speakr with a reverse proxy that strips next query parameters on the /login route, or block requests where next starts with //, \, or contains a scheme [1].