CVE-2025-62379 (GCVE-0-2025-62379)
Vulnerability from cvelistv5 – Published: 2025-10-15 15:57 – Updated: 2025-10-15 17:18
VLAI
EPSS
VEX
Title
Open Redirect in reflex-dev/reflex
Summary
Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redirect_to query parameter value directly to client-side links without any validation and triggers automatic clicks when the page loads in a GitHub Codespaces environment. This allows attackers to redirect users to arbitrary external URLs. The vulnerable route is only registered when a Codespaces environment is detected, and the detection is controlled by environment variables. The same behavior can be activated in production if the GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN environment variable is set. The vulnerability occurs because the code assigns the redirect_to query parameter directly to a.href without any validation and immediately triggers a click (automatic navigation), allowing users to be sent to arbitrary external domains. The execution condition is based on the presence of a sessionStorage flag, meaning it triggers immediately on first visits or in incognito/private browsing windows, with no server-side origin/scheme whitelist or internal path enforcement defenses in place. This issue has been patched in version 0.8.15. As a workaround, users can ensure that GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN is not set in a production environment.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-15 17:17 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/reflex-dev/reflex/security/adv… | x_refsource_CONFIRM |
| https://github.com/reflex-dev/reflex/commit/ade12… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| reflex-dev | reflex |
Affected:
>= 0.5.4, < 0.8.15
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-62379",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-15T17:17:48.463909Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-15T17:18:15.450Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "reflex",
"vendor": "reflex-dev",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.5.4, \u003c 0.8.15"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redirect_to query parameter value directly to client-side links without any validation and triggers automatic clicks when the page loads in a GitHub Codespaces environment. This allows attackers to redirect users to arbitrary external URLs. The vulnerable route is only registered when a Codespaces environment is detected, and the detection is controlled by environment variables. The same behavior can be activated in production if the GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN environment variable is set. The vulnerability occurs because the code assigns the redirect_to query parameter directly to a.href without any validation and immediately triggers a click (automatic navigation), allowing users to be sent to arbitrary external domains. The execution condition is based on the presence of a sessionStorage flag, meaning it triggers immediately on first visits or in incognito/private browsing windows, with no server-side origin/scheme whitelist or internal path enforcement defenses in place. This issue has been patched in version 0.8.15. As a workaround, users can ensure that GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN is not set in a production environment."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-15T15:57:57.208Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/reflex-dev/reflex/security/advisories/GHSA-rfh5-c9h5-q8jm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/reflex-dev/reflex/security/advisories/GHSA-rfh5-c9h5-q8jm"
},
{
"name": "https://github.com/reflex-dev/reflex/commit/ade12549f3c0ddab3d7382c581bc04a3c1f989ec",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/reflex-dev/reflex/commit/ade12549f3c0ddab3d7382c581bc04a3c1f989ec"
}
],
"source": {
"advisory": "GHSA-rfh5-c9h5-q8jm",
"discovery": "UNKNOWN"
},
"title": "Open Redirect in reflex-dev/reflex"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-62379",
"datePublished": "2025-10-15T15:57:57.208Z",
"dateReserved": "2025-10-10T14:22:48.205Z",
"dateUpdated": "2025-10-15T17:18:15.450Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-62379",
"date": "2026-09-18",
"epss": "0.00253",
"percentile": "0.1712"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "reflex",
"vendor": "reflex-dev",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.5.4, \u003c 0.8.15"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redirect_to query parameter value directly to client-side links without any validation and triggers automatic clicks when the page loads in a GitHub Codespaces environment. This allows attackers to redirect users to arbitrary external URLs. The vulnerable route is only registered when a Codespaces environment is detected, and the detection is controlled by environment variables. The same behavior can be activated in production if the GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN environment variable is set. The vulnerability occurs because the code assigns the redirect_to query parameter directly to a.href without any validation and immediately triggers a click (automatic navigation), allowing users to be sent to arbitrary external domains. The execution condition is based on the presence of a sessionStorage flag, meaning it triggers immediately on first visits or in incognito/private browsing windows, with no server-side origin/scheme whitelist or internal path enforcement defenses in place. This issue has been patched in version 0.8.15. As a workaround, users can ensure that GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN is not set in a production environment."
}
],
"id": "CVE-2025-62379",
"lastModified": "2026-06-17T09:51:47.843",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 1.4,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-62379",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-15T17:17:48.463909Z",
"version": "2.0.3"
}
}
]
},
"published": "2025-10-15T16:15:36.357",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/reflex-dev/reflex/commit/ade12549f3c0ddab3d7382c581bc04a3c1f989ec"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/reflex-dev/reflex/security/advisories/GHSA-rfh5-c9h5-q8jm"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-601"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2025-10-16T16:01:13+00:00",
"cve": "CVE-2025-62379",
"id": "CVE-2025-62379",
"initial_release_date": "2025-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "Open Redirect in reflex-dev/reflex",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-62379.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-62379",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-15T17:17:48.463909Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-15T17:18:00.510Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "reflex",
"vendor": "reflex-dev",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.5.4, \u003c 0.8.15"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redirect_to query parameter value directly to client-side links without any validation and triggers automatic clicks when the page loads in a GitHub Codespaces environment. This allows attackers to redirect users to arbitrary external URLs. The vulnerable route is only registered when a Codespaces environment is detected, and the detection is controlled by environment variables. The same behavior can be activated in production if the GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN environment variable is set. The vulnerability occurs because the code assigns the redirect_to query parameter directly to a.href without any validation and immediately triggers a click (automatic navigation), allowing users to be sent to arbitrary external domains. The execution condition is based on the presence of a sessionStorage flag, meaning it triggers immediately on first visits or in incognito/private browsing windows, with no server-side origin/scheme whitelist or internal path enforcement defenses in place. This issue has been patched in version 0.8.15. As a workaround, users can ensure that GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN is not set in a production environment."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-15T15:57:57.208Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/reflex-dev/reflex/security/advisories/GHSA-rfh5-c9h5-q8jm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/reflex-dev/reflex/security/advisories/GHSA-rfh5-c9h5-q8jm"
},
{
"name": "https://github.com/reflex-dev/reflex/commit/ade12549f3c0ddab3d7382c581bc04a3c1f989ec",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/reflex-dev/reflex/commit/ade12549f3c0ddab3d7382c581bc04a3c1f989ec"
}
],
"source": {
"advisory": "GHSA-rfh5-c9h5-q8jm",
"discovery": "UNKNOWN"
},
"title": "Open Redirect in reflex-dev/reflex"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-62379",
"datePublished": "2025-10-15T15:57:57.208Z",
"dateReserved": "2025-10-10T14:22:48.205Z",
"dateUpdated": "2025-10-15T17:18:15.450Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
FKIE_CVE-2025-62379
Vulnerability from fkie_nvd - Published: 2025-10-15 16:15 - Updated: 2026-06-17 09:51
Severity
Summary
Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redirect_to query parameter value directly to client-side links without any validation and triggers automatic clicks when the page loads in a GitHub Codespaces environment. This allows attackers to redirect users to arbitrary external URLs. The vulnerable route is only registered when a Codespaces environment is detected, and the detection is controlled by environment variables. The same behavior can be activated in production if the GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN environment variable is set. The vulnerability occurs because the code assigns the redirect_to query parameter directly to a.href without any validation and immediately triggers a click (automatic navigation), allowing users to be sent to arbitrary external domains. The execution condition is based on the presence of a sessionStorage flag, meaning it triggers immediately on first visits or in incognito/private browsing windows, with no server-side origin/scheme whitelist or internal path enforcement defenses in place. This issue has been patched in version 0.8.15. As a workaround, users can ensure that GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN is not set in a production environment.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"product": "reflex",
"vendor": "reflex-dev",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.5.4, \u003c 0.8.15"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redirect_to query parameter value directly to client-side links without any validation and triggers automatic clicks when the page loads in a GitHub Codespaces environment. This allows attackers to redirect users to arbitrary external URLs. The vulnerable route is only registered when a Codespaces environment is detected, and the detection is controlled by environment variables. The same behavior can be activated in production if the GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN environment variable is set. The vulnerability occurs because the code assigns the redirect_to query parameter directly to a.href without any validation and immediately triggers a click (automatic navigation), allowing users to be sent to arbitrary external domains. The execution condition is based on the presence of a sessionStorage flag, meaning it triggers immediately on first visits or in incognito/private browsing windows, with no server-side origin/scheme whitelist or internal path enforcement defenses in place. This issue has been patched in version 0.8.15. As a workaround, users can ensure that GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN is not set in a production environment."
}
],
"id": "CVE-2025-62379",
"lastModified": "2026-06-17T09:51:47.843",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 1.4,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-62379",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-15T17:17:48.463909Z",
"version": "2.0.3"
}
}
]
},
"published": "2025-10-15T16:15:36.357",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/reflex-dev/reflex/commit/ade12549f3c0ddab3d7382c581bc04a3c1f989ec"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/reflex-dev/reflex/security/advisories/GHSA-rfh5-c9h5-q8jm"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-601"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-RFH5-C9H5-Q8JM
Vulnerability from github – Published: 2025-10-15 17:56 – Updated: 2025-10-15 19:14
VLAI
Summary
reflex-dev/reflex has an Open Redirect vulnerability
Details
Mitigation
Make sure GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN is not set in a production environment. So the following is correct:
assert os.getenv("GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN") is None
Vulnerability Description
Vulnerability Overview
- When the GET /auth-codespace page loads in a GitHub Codespaces environment, it automatically assigns the redirect_to query parameter value directly to client-side links without any validation and triggers automatic clicks. This allows attackers to redirect users to arbitrary external URLs.
- The route is only registered when a Codespaces environment is detected, and the detection is controlled by environment variables. This means that the same behavior can be activated in production if the corresponding environment variable is set.
Vulnerable Code Analysis
https://github.com/reflex-dev/reflex/blob/51f9f2c2f52cac4d66c07683a12bc0237311b6be/reflex/utils/codespaces.py#L18-L46
- This code assigns the redirect_to query parameter directly to a.href without any validation and immediately triggers a click (automatic navigation), allowing users to be sent to arbitrary external domains, resulting in an open redirect vulnerability.
- The execution condition is simply based on the presence of a sessionStorage flag, meaning it triggers immediately on first visits or in incognito/private browsing windows, with no server-side origin/scheme whitelist or internal path enforcement defenses in place.
PoC
PoC Description
- Used the production configuration from docker-example (docker-example/production-compose).
- Added a Codespaces detection environment variable to the app container in compose.yaml to forcibly expose the route.
- GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN: dummy
- The reverse proxy (Caddy) needs to be configured to forward /auth-codespace to the backend (required depending on the environment).
curl Example
https://localhost/auth-codespace?redirect_to=http://google.com
PoC MP4 https://file.notion.so/f/f/d105d145-04bc-45c5-b46c-ed880895e9de/a86c3e3b-f67f-45d1-8fa2-4aa0ba7d0068/poc.mp4?table=block&id=26955717-5d2e-805a-b53c-e25ee03f1d4b&spaceId=d105d145-04bc-45c5-b46c-ed880895e9de&expirationTimestamp=1760508000000&signature=ZPp8PVldfGOh0gB5tVElRV6GN789R-EG0oxZgkFjjLU&downloadName=poc.mp4
Impact
Phishing/Social Engineering Attacks
Users can be exploited by immediately redirecting from a trusted domain to external malicious sites, taking advantage of user trust. This enables login page spoofing, credential harvesting, and redirection to malware distribution pages.
Authentication/Session Flow Disruption
When users with valid sessions/cookies from the same origin click the link, they are redirected to unintended external domains, which can bypass or disrupt authentication/authorization flows. When combined with redirect-based flows like OAuth/OIDC, this can escalate into security incidents.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "reflex"
},
"ranges": [
{
"events": [
{
"introduced": "0.5.4"
},
{
"last_affected": "0.8.14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-62379"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-15T17:56:32Z",
"nvd_published_at": "2025-10-15T16:15:36Z",
"severity": "LOW"
},
"details": "### Mitigation\n\nMake sure `GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN` is not set in a production environment. So the following is correct:\n\n```\nassert os.getenv(\"GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN\") is None\n```\n\n### **Vulnerability Description**\n\n---\n\n**Vulnerability Overview**\n \n- When the\u00a0GET\u00a0/auth-codespace page loads in a GitHub Codespaces environment, it automatically assigns the\u00a0redirect_to\u00a0query parameter value directly\u00a0to client-side links without any validation and triggers automatic\u00a0clicks. This\u00a0allows attackers\u00a0to redirect users to arbitrary external URLs.\n- The route is\u00a0only registered when a Codespaces environment\u00a0is detected, and the detection is controlled by environment variables. This\u00a0means that the\u00a0same behavior can be activated in production\u00a0if the corresponding environment\u00a0variable is set.\n\n**Vulnerable\u00a0Code Analysis**\n \n\nhttps://github.com/reflex-dev/reflex/blob/51f9f2c2f52cac4d66c07683a12bc0237311b6be/reflex/utils/codespaces.py#L18-L46\n\n- This code assigns the\u00a0redirect_to\u00a0query parameter\u00a0directly\u00a0to\u00a0a.href\u00a0without any validation and immediately triggers a click\u00a0(automatic navigation), allowing\u00a0users to be sent to arbitrary external domains, resulting\u00a0in an open redirect vulnerability.\n- The\u00a0execution condition is\u00a0simply based\u00a0on\u00a0the presence of a\u00a0sessionStorage\u00a0flag, meaning it\u00a0triggers\u00a0immediately on first\u00a0visits or\u00a0in incognito/private browsing windows, with no\u00a0server-side origin/scheme whitelist or internal path\u00a0enforcement defenses in place.\n\n### PoC\n\n---\n\n**PoC Description**\n \n\n\u003cimg width=\"623\" height=\"497\" alt=\"image\" src=\"https://github.com/user-attachments/assets/55ef4828-09fa-451b-a7cc-8fcaad6a2a21\" /\u003e\n\n\n- Used the production configuration\u00a0from docker-example (docker-example/production-compose).\n- Added a\u00a0Codespaces detection environment\u00a0variable to the app\u00a0container in compose.yaml to forcibly expose the\u00a0route.\n- GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN:\u00a0dummy\n- The\u00a0reverse proxy (Caddy) needs to be configured\u00a0to forward\u00a0/auth-codespace\u00a0to the backend\u00a0(required depending on the environment).\n\n**curl Example**\n\n\n```\nhttps://localhost/auth-codespace?redirect_to=http://google.com\n```\n\n**PoC MP4**\nhttps://file.notion.so/f/f/d105d145-04bc-45c5-b46c-ed880895e9de/a86c3e3b-f67f-45d1-8fa2-4aa0ba7d0068/poc.mp4?table=block\u0026id=26955717-5d2e-805a-b53c-e25ee03f1d4b\u0026spaceId=d105d145-04bc-45c5-b46c-ed880895e9de\u0026expirationTimestamp=1760508000000\u0026signature=ZPp8PVldfGOh0gB5tVElRV6GN789R-EG0oxZgkFjjLU\u0026downloadName=poc.mp4\n\n\u003cimg width=\"1917\" height=\"949\" alt=\"image\" src=\"https://github.com/user-attachments/assets/e565dc4e-a59b-44d4-a92a-ebf128489e88\" /\u003e\n\n\u003cimg width=\"1913\" height=\"977\" alt=\"image\" src=\"https://github.com/user-attachments/assets/496fa585-76ea-4d2d-80f8-0ab79f51229e\" /\u003e\n\n\n\n\n### Impact\n\n---\n\n**Phishing/Social Engineering\u00a0Attacks**\n\n\nUsers can be exploited by immediately redirecting from a trusted domain to external malicious sites, taking advantage of user trust. This enables login page spoofing, credential harvesting, and redirection to malware distribution pages.\n\n**Authentication/Session\u00a0Flow Disruption**\n \n\nWhen users with valid sessions/cookies from the same origin click the link, they are redirected to unintended external domains, which can bypass or disrupt authentication/authorization flows. When combined with redirect-based flows like OAuth/OIDC, this can escalate into security incidents.",
"id": "GHSA-rfh5-c9h5-q8jm",
"modified": "2025-10-15T19:14:33Z",
"published": "2025-10-15T17:56:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/reflex-dev/reflex/security/advisories/GHSA-rfh5-c9h5-q8jm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62379"
},
{
"type": "WEB",
"url": "https://github.com/reflex-dev/reflex/commit/ade12549f3c0ddab3d7382c581bc04a3c1f989ec"
},
{
"type": "WEB",
"url": "https://file.notion.so/f/f/d105d145-04bc-45c5-b46c-ed880895e9de/a86c3e3b-f67f-45d1-8fa2-4aa0ba7d0068/poc.mp4?table=block\u0026id=26955717-5d2e-805a-b53c-e25ee03f1d4b\u0026spaceId=d105d145-04bc-45c5-b46c-ed880895e9de\u0026expirationTimestamp=1760508000000\u0026signature=ZPp8PVldfGOh0gB5tVElRV6GN789R-EG0oxZgkFjjLU\u0026downloadName=poc.mp4"
},
{
"type": "PACKAGE",
"url": "https://github.com/reflex-dev/reflex"
},
{
"type": "WEB",
"url": "https://github.com/reflex-dev/reflex/blob/51f9f2c2f52cac4d66c07683a12bc0237311b6be/reflex/utils/codespaces.py#L18-L46"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "reflex-dev/reflex has an Open Redirect vulnerability"
}
PYSEC-2026-1868
Vulnerability from pysec - Published: 2026-07-07 16:03 - Updated: 2026-07-07 17:25
VLAI
Details
Mitigation
Make sure GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN is not set in a production environment. So the following is correct:
assert os.getenv("GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN") is None
Vulnerability Description
Vulnerability Overview
- When the GET /auth-codespace page loads in a GitHub Codespaces environment, it automatically assigns the redirect_to query parameter value directly to client-side links without any validation and triggers automatic clicks. This allows attackers to redirect users to arbitrary external URLs.
- The route is only registered when a Codespaces environment is detected, and the detection is controlled by environment variables. This means that the same behavior can be activated in production if the corresponding environment variable is set.
Vulnerable Code Analysis
https://github.com/reflex-dev/reflex/blob/51f9f2c2f52cac4d66c07683a12bc0237311b6be/reflex/utils/codespaces.py#L18-L46
- This code assigns the redirect_to query parameter directly to a.href without any validation and immediately triggers a click (automatic navigation), allowing users to be sent to arbitrary external domains, resulting in an open redirect vulnerability.
- The execution condition is simply based on the presence of a sessionStorage flag, meaning it triggers immediately on first visits or in incognito/private browsing windows, with no server-side origin/scheme whitelist or internal path enforcement defenses in place.
PoC
PoC Description
- Used the production configuration from docker-example (docker-example/production-compose).
- Added a Codespaces detection environment variable to the app container in compose.yaml to forcibly expose the route.
- GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN: dummy
- The reverse proxy (Caddy) needs to be configured to forward /auth-codespace to the backend (required depending on the environment).
curl Example
https://localhost/auth-codespace?redirect_to=http://google.com
PoC MP4 https://file.notion.so/f/f/d105d145-04bc-45c5-b46c-ed880895e9de/a86c3e3b-f67f-45d1-8fa2-4aa0ba7d0068/poc.mp4?table=block&id=26955717-5d2e-805a-b53c-e25ee03f1d4b&spaceId=d105d145-04bc-45c5-b46c-ed880895e9de&expirationTimestamp=1760508000000&signature=ZPp8PVldfGOh0gB5tVElRV6GN789R-EG0oxZgkFjjLU&downloadName=poc.mp4
Impact
Phishing/Social Engineering Attacks
Users can be exploited by immediately redirecting from a trusted domain to external malicious sites, taking advantage of user trust. This enables login page spoofing, credential harvesting, and redirection to malware distribution pages.
Authentication/Session Flow Disruption
When users with valid sessions/cookies from the same origin click the link, they are redirected to unintended external domains, which can bypass or disrupt authentication/authorization flows. When combined with redirect-based flows like OAuth/OIDC, this can escalate into security incidents.
Severity
Impacted products
| Name | purl | reflex | pkg:pypi/reflex |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "reflex",
"purl": "pkg:pypi/reflex"
},
"ranges": [
{
"events": [
{
"introduced": "0.5.4"
},
{
"last_affected": "0.8.14"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.5.10",
"0.5.10.post1",
"0.5.10a1",
"0.5.10a2",
"0.5.10a3",
"0.5.4",
"0.5.5",
"0.5.5a1",
"0.5.5a2",
"0.5.6",
"0.5.6a1",
"0.5.6a2",
"0.5.7",
"0.5.7a1",
"0.5.8",
"0.5.8a1",
"0.5.9",
"0.5.9.dev1",
"0.5.9a1",
"0.6.0",
"0.6.0a1",
"0.6.0a2",
"0.6.0a3",
"0.6.0a4",
"0.6.1",
"0.6.1a1",
"0.6.1a2",
"0.6.2",
"0.6.2.post1",
"0.6.2a1",
"0.6.2a2",
"0.6.3",
"0.6.3.post1",
"0.6.3a1",
"0.6.3a2",
"0.6.3a3",
"0.6.3a4",
"0.6.4",
"0.6.4a1",
"0.6.4a2",
"0.6.4a3",
"0.6.5",
"0.6.5a1",
"0.6.5a2",
"0.6.5a3",
"0.6.6",
"0.6.6.post1",
"0.6.6.post2",
"0.6.6.post3",
"0.6.6a1",
"0.6.6a2",
"0.6.6a3",
"0.6.7",
"0.6.7a1",
"0.6.7a2",
"0.6.8",
"0.6.8.post1",
"0.6.8a1",
"0.6.8a2",
"0.7.0",
"0.7.0.post1",
"0.7.0a1",
"0.7.0a2",
"0.7.0a3",
"0.7.0a4",
"0.7.0a5",
"0.7.1",
"0.7.1.post1",
"0.7.10",
"0.7.10.post1",
"0.7.10a1",
"0.7.11",
"0.7.11a1",
"0.7.12",
"0.7.12a1",
"0.7.13",
"0.7.13a1",
"0.7.13a2",
"0.7.14",
"0.7.14a1",
"0.7.14a2",
"0.7.14a3",
"0.7.14a4",
"0.7.14a5",
"0.7.14a6",
"0.7.1a1",
"0.7.1a2",
"0.7.1a3",
"0.7.1a4",
"0.7.1a5",
"0.7.2",
"0.7.2.dev1",
"0.7.2.post1",
"0.7.2a1",
"0.7.2a2",
"0.7.3",
"0.7.3.post1",
"0.7.3a1",
"0.7.3a2",
"0.7.4",
"0.7.4.post1",
"0.7.4a0",
"0.7.4a1",
"0.7.4a2",
"0.7.4a3",
"0.7.5",
"0.7.5.post1",
"0.7.5a1",
"0.7.6",
"0.7.6.post1",
"0.7.6a0",
"0.7.6a1",
"0.7.7",
"0.7.7.post1",
"0.7.7a1",
"0.7.7a2",
"0.7.8",
"0.7.8.post1",
"0.7.8a1",
"0.7.9",
"0.7.9.post1",
"0.7.9a1",
"0.7.9a2",
"0.8.0",
"0.8.0.post1",
"0.8.0a1",
"0.8.0a2",
"0.8.0a3",
"0.8.0a4",
"0.8.0a5",
"0.8.0a6",
"0.8.0a7",
"0.8.1",
"0.8.1.post1",
"0.8.10",
"0.8.10a1",
"0.8.11",
"0.8.11a1",
"0.8.12",
"0.8.12a1",
"0.8.12a2",
"0.8.13",
"0.8.13a1",
"0.8.14",
"0.8.14a1",
"0.8.14a2",
"0.8.1a1",
"0.8.1a2",
"0.8.2",
"0.8.2a1",
"0.8.3",
"0.8.3a1",
"0.8.3a2",
"0.8.3a3",
"0.8.4",
"0.8.4a1",
"0.8.4a2",
"0.8.5",
"0.8.5a1",
"0.8.5a2",
"0.8.6",
"0.8.6a0",
"0.8.6a1",
"0.8.7",
"0.8.7a1",
"0.8.8",
"0.8.8a1",
"0.8.8a2",
"0.8.9",
"0.8.9a1",
"0.8.9a2"
]
}
],
"aliases": [
"CVE-2025-62379",
"GHSA-rfh5-c9h5-q8jm"
],
"details": "### Mitigation\n\nMake sure `GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN` is not set in a production environment. So the following is correct:\n\n```\nassert os.getenv(\"GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN\") is None\n```\n\n### **Vulnerability Description**\n\n---\n\n**Vulnerability Overview**\n \n- When the\u00a0GET\u00a0/auth-codespace page loads in a GitHub Codespaces environment, it automatically assigns the\u00a0redirect_to\u00a0query parameter value directly\u00a0to client-side links without any validation and triggers automatic\u00a0clicks. This\u00a0allows attackers\u00a0to redirect users to arbitrary external URLs.\n- The route is\u00a0only registered when a Codespaces environment\u00a0is detected, and the detection is controlled by environment variables. This\u00a0means that the\u00a0same behavior can be activated in production\u00a0if the corresponding environment\u00a0variable is set.\n\n**Vulnerable\u00a0Code Analysis**\n \n\nhttps://github.com/reflex-dev/reflex/blob/51f9f2c2f52cac4d66c07683a12bc0237311b6be/reflex/utils/codespaces.py#L18-L46\n\n- This code assigns the\u00a0redirect_to\u00a0query parameter\u00a0directly\u00a0to\u00a0a.href\u00a0without any validation and immediately triggers a click\u00a0(automatic navigation), allowing\u00a0users to be sent to arbitrary external domains, resulting\u00a0in an open redirect vulnerability.\n- The\u00a0execution condition is\u00a0simply based\u00a0on\u00a0the presence of a\u00a0sessionStorage\u00a0flag, meaning it\u00a0triggers\u00a0immediately on first\u00a0visits or\u00a0in incognito/private browsing windows, with no\u00a0server-side origin/scheme whitelist or internal path\u00a0enforcement defenses in place.\n\n### PoC\n\n---\n\n**PoC Description**\n \n\n\u003cimg width=\"623\" height=\"497\" alt=\"image\" src=\"https://github.com/user-attachments/assets/55ef4828-09fa-451b-a7cc-8fcaad6a2a21\" /\u003e\n\n\n- Used the production configuration\u00a0from docker-example (docker-example/production-compose).\n- Added a\u00a0Codespaces detection environment\u00a0variable to the app\u00a0container in compose.yaml to forcibly expose the\u00a0route.\n- GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN:\u00a0dummy\n- The\u00a0reverse proxy (Caddy) needs to be configured\u00a0to forward\u00a0/auth-codespace\u00a0to the backend\u00a0(required depending on the environment).\n\n**curl Example**\n\n\n```\nhttps://localhost/auth-codespace?redirect_to=http://google.com\n```\n\n**PoC MP4**\nhttps://file.notion.so/f/f/d105d145-04bc-45c5-b46c-ed880895e9de/a86c3e3b-f67f-45d1-8fa2-4aa0ba7d0068/poc.mp4?table=block\u0026id=26955717-5d2e-805a-b53c-e25ee03f1d4b\u0026spaceId=d105d145-04bc-45c5-b46c-ed880895e9de\u0026expirationTimestamp=1760508000000\u0026signature=ZPp8PVldfGOh0gB5tVElRV6GN789R-EG0oxZgkFjjLU\u0026downloadName=poc.mp4\n\n\u003cimg width=\"1917\" height=\"949\" alt=\"image\" src=\"https://github.com/user-attachments/assets/e565dc4e-a59b-44d4-a92a-ebf128489e88\" /\u003e\n\n\u003cimg width=\"1913\" height=\"977\" alt=\"image\" src=\"https://github.com/user-attachments/assets/496fa585-76ea-4d2d-80f8-0ab79f51229e\" /\u003e\n\n\n\n\n### Impact\n\n---\n\n**Phishing/Social Engineering\u00a0Attacks**\n\n\nUsers can be exploited by immediately redirecting from a trusted domain to external malicious sites, taking advantage of user trust. This enables login page spoofing, credential harvesting, and redirection to malware distribution pages.\n\n**Authentication/Session\u00a0Flow Disruption**\n \n\nWhen users with valid sessions/cookies from the same origin click the link, they are redirected to unintended external domains, which can bypass or disrupt authentication/authorization flows. When combined with redirect-based flows like OAuth/OIDC, this can escalate into security incidents.",
"id": "PYSEC-2026-1868",
"modified": "2026-07-07T17:25:17.179056Z",
"published": "2026-07-07T16:03:07.777195Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/reflex-dev/reflex/security/advisories/GHSA-rfh5-c9h5-q8jm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62379"
},
{
"type": "WEB",
"url": "https://github.com/reflex-dev/reflex/commit/ade12549f3c0ddab3d7382c581bc04a3c1f989ec"
},
{
"type": "WEB",
"url": "https://file.notion.so/f/f/d105d145-04bc-45c5-b46c-ed880895e9de/a86c3e3b-f67f-45d1-8fa2-4aa0ba7d0068/poc.mp4?table=block\u0026id=26955717-5d2e-805a-b53c-e25ee03f1d4b\u0026spaceId=d105d145-04bc-45c5-b46c-ed880895e9de\u0026expirationTimestamp=1760508000000\u0026signature=ZPp8PVldfGOh0gB5tVElRV6GN789R-EG0oxZgkFjjLU\u0026downloadName=poc.mp4"
},
{
"type": "PACKAGE",
"url": "https://github.com/reflex-dev/reflex"
},
{
"type": "WEB",
"url": "https://github.com/reflex-dev/reflex/blob/51f9f2c2f52cac4d66c07683a12bc0237311b6be/reflex/utils/codespaces.py#L18-L46"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/reflex"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-rfh5-c9h5-q8jm"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "reflex-dev/reflex has an Open Redirect vulnerability"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…