CVE-2026-55185 in Miniflux is an open redirect vulnerability with an attack surface that exceeds what its CVSS 5.1 score suggests. The core issue is a semantic gap between Go's URL parser and browser behavior: Go treats backslashes as opaque path characters, while browsers normalize them to forward slashes. A crafted redirect_url parameter containing \example.com passes server-side validation as a relative path, but resolves to an external domain in a user's browser.
What elevates this beyond a typical open redirect is the pre-authentication trigger point. The login flow itself processes the redirect parameter before any authentication occurs. This shifts the threat model from 'authenticated users who might click a bad link' to 'anyone who receives a crafted link in a phishing email.' An attacker doesn't need a valid session to exploit this — they need only to convince a victim to click.
For defenders running Miniflux, the priority is straightforward: upgrade to version 2.3.1 or later, where the fix rejects backslashes in the path validation logic. If patching is not immediately possible, examine your login handler's redirect logic and add explicit rejection of backslashes in the redirect_url parameter before any redirect is performed. The fix is a single-character-class modification, but that simplicity should not minimize the urgency — the pre-authentication vector means the exploit requires nothing more than a click.
Consider also whether your deployment exposes Miniflux directly to the internet. Self-hosted instances behind NAT face reduced risk since attackers would need network proximity. Internet-facing instances carry the full phishing risk. If you operate Miniflux as a shared service or in an environment where users manage feed sources, assess whether an external redirect could chain with the application's feed-fetching capabilities — the blast radius depends on what the victim can do after landing on the attacker's domain.
The broader pattern here is worth noting: backslash normalization exploits have appeared across Python, Node.js, PHP, and now Go. Each instance has an trivially simple fix, which paradoxically means the underlying semantic gap rarely receives the documentation or tooling attention needed to prevent recurrence. Until Go's standard library documentation or static analysis tools explicitly warn about this parsing mismatch, expect similar issues in other Go web applications.