CVE-2026-45307 Details
Description
Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.20-alpha, the is_safe_url() helper used to validate post-login redirect targets applied urljoin(request.host_url, target) before parsing, while the controller passed the raw target to redirect(). A scheme-relative input such as ////evil.com resolved to a same-host URL during validation but was emitted verbatim in the Location header, where the browser interpreted it as a network-path-relative redirect to an attacker-controlled host. This vulnerability is fixed in 0.8.20-alpha.
An open redirect vulnerability has been identified in Speakr, a self-hosted web application for transcribing audio recordings, in versions prior to 0.8.20-alpha. The issue arises in the is_safe_url() helper, which validates post-login redirect targets. The helper incorrectly processed scheme-relative URLs by resolving them to the same host during validation, while the raw URL was sent unmodified in the Location header. This allowed for redirection to an attacker-controlled site after login, potentially initiating phishing attacks from a trusted Speakr deployment.
Users can upgrade to Speakr version 0.8.20-alpha or later, where this vulnerability has been fixed. Those unable to upgrade immediately can use a reverse proxy to remove 'next' query parameters from login requests or block requests containing certain URL schemes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/murtaza-nasir/speakr/security/advisories/GHSA-5cpp-mqgh-4c38 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/murtaza-nasir/speakr/security/advisories/GHSA-5cpp-mqgh-4c38 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Speakr | <= 0.8.19-alpha (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |