CVE-2026-25477

AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.26.0, there is an Open Redirect vulnerability located at the /redirect-proxy endpoint. The flaw exists in the domain validation logic, where an improperly anchored Regular Expression allows an attacker to bypass the whitelist by using malicious domains that end with a trusted string. This issue has been patched in version 0.26.0.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/toeverything/AFFiNE/security/advisories/GHSA-wx9m-v7wq-g289	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:affine:affine:*:*:*:*:-:*:*:*

History

10 Apr 2026, 14:28

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.1
CPE		cpe:2.3:a:affine:affine:::::-:::*
References	~~() https://github.com/toeverything/AFFiNE/security/advisories/GHSA-wx9m-v7wq-g289 -~~	() https://github.com/toeverything/AFFiNE/security/advisories/GHSA-wx9m-v7wq-g289 - Third Party Advisory
Summary		(es) AFFiNE es un espacio de trabajo todo en uno de código abierto y un sistema operativo. Antes de la versión 0.26.0, existe una vulnerabilidad de redirección abierta ubicada en el endpoint /redirect-proxy. El fallo reside en la lógica de validación de dominio, donde una expresión regular anclada incorrectamente permite a un atacante eludir la lista blanca utilizando dominios maliciosos que terminan con una cadena de confianza. Este problema ha sido parcheado en la versión 0.26.0.
First Time		Affine Affine affine

02 Mar 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-02 20:16

Updated : 2026-06-17 10:24

NVD link : CVE-2026-25477

Mitre link : CVE-2026-25477

CVE.ORG link : CVE-2026-25477

JSON object : View

Products Affected

affine

affine

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2026-25477", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25477", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-02T20:29:57.272805Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "toeverything", "product": "AFFiNE", "versions": [{"status": "affected", "version": "< 0.26.0"}]}]}], "published": "2026-03-02T20:16:26.407", "references": [{"url": "https://github.com/toeverything/AFFiNE/security/advisories/GHSA-wx9m-v7wq-g289", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.26.0, there is an Open Redirect vulnerability located at the /redirect-proxy endpoint. The flaw exists in the domain validation logic, where an improperly anchored Regular Expression allows an attacker to bypass the whitelist by using malicious domains that end with a trusted string. This issue has been patched in version 0.26.0."}, {"lang": "es", "value": "AFFiNE es un espacio de trabajo todo en uno de c\u00f3digo abierto y un sistema operativo. Antes de la versi\u00f3n 0.26.0, existe una vulnerabilidad de redirecci\u00f3n abierta ubicada en el endpoint /redirect-proxy. El fallo reside en la l\u00f3gica de validaci\u00f3n de dominio, donde una expresi\u00f3n regular anclada incorrectamente permite a un atacante eludir la lista blanca utilizando dominios maliciosos que terminan con una cadena de confianza. Este problema ha sido parcheado en la versi\u00f3n 0.26.0."}], "lastModified": "2026-06-17T10:24:42.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:affine:affine:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "6BA71CFE-9304-4226-80A6-87C7B6CB89B6", "versionEndExcluding": "0.26.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}