{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "reflex"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.5.4"
            },
            {
              "last_affected": "0.8.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-62379"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-15T17:56:32Z",
    "nvd_published_at": "2025-10-15T16:15:36Z",
    "severity": "LOW"
  },
  "details": "### Mitigation\n\nMake sure `GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN` is not set in a production environment. So the following is correct:\n\n```\nassert os.getenv(\"GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN\") is None\n```\n\n### **Vulnerability Description**\n\n---\n\n**Vulnerability Overview**\n \n- When the\u00a0GET\u00a0/auth-codespace page loads in a GitHub Codespaces environment, it automatically assigns the\u00a0redirect_to\u00a0query parameter value directly\u00a0to client-side links without any validation and triggers automatic\u00a0clicks. This\u00a0allows attackers\u00a0to redirect users to arbitrary external URLs.\n- The route is\u00a0only registered when a Codespaces environment\u00a0is detected, and the detection is controlled by environment variables. This\u00a0means that the\u00a0same behavior can be activated in production\u00a0if the corresponding environment\u00a0variable is set.\n\n**Vulnerable\u00a0Code Analysis**\n \n\nhttps://github.com/reflex-dev/reflex/blob/51f9f2c2f52cac4d66c07683a12bc0237311b6be/reflex/utils/codespaces.py#L18-L46\n\n- This code assigns the\u00a0redirect_to\u00a0query parameter\u00a0directly\u00a0to\u00a0a.href\u00a0without any validation and immediately triggers a click\u00a0(automatic navigation), allowing\u00a0users to be sent to arbitrary external domains, resulting\u00a0in an open redirect vulnerability.\n- The\u00a0execution condition is\u00a0simply based\u00a0on\u00a0the presence of a\u00a0sessionStorage\u00a0flag, meaning it\u00a0triggers\u00a0immediately on first\u00a0visits or\u00a0in incognito/private browsing windows, with no\u00a0server-side origin/scheme whitelist or internal path\u00a0enforcement defenses in place.\n\n### PoC\n\n---\n\n**PoC Description**\n \n\n\u003cimg width=\"623\" height=\"497\" alt=\"image\" src=\"https://github.com/user-attachments/assets/55ef4828-09fa-451b-a7cc-8fcaad6a2a21\" /\u003e\n\n\n- Used the production configuration\u00a0from docker-example (docker-example/production-compose).\n- Added a\u00a0Codespaces detection environment\u00a0variable to the app\u00a0container in compose.yaml to forcibly expose the\u00a0route.\n- GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN:\u00a0dummy\n- The\u00a0reverse proxy (Caddy) needs to be configured\u00a0to forward\u00a0/auth-codespace\u00a0to the backend\u00a0(required depending on the environment).\n\n**curl Example**\n\n\n```\nhttps://localhost/auth-codespace?redirect_to=http://google.com\n```\n\n**PoC MP4**\nhttps://file.notion.so/f/f/d105d145-04bc-45c5-b46c-ed880895e9de/a86c3e3b-f67f-45d1-8fa2-4aa0ba7d0068/poc.mp4?table=block\u0026id=26955717-5d2e-805a-b53c-e25ee03f1d4b\u0026spaceId=d105d145-04bc-45c5-b46c-ed880895e9de\u0026expirationTimestamp=1760508000000\u0026signature=ZPp8PVldfGOh0gB5tVElRV6GN789R-EG0oxZgkFjjLU\u0026downloadName=poc.mp4\n\n\u003cimg width=\"1917\" height=\"949\" alt=\"image\" src=\"https://github.com/user-attachments/assets/e565dc4e-a59b-44d4-a92a-ebf128489e88\" /\u003e\n\n\u003cimg width=\"1913\" height=\"977\" alt=\"image\" src=\"https://github.com/user-attachments/assets/496fa585-76ea-4d2d-80f8-0ab79f51229e\" /\u003e\n\n\n\n\n### Impact\n\n---\n\n**Phishing/Social Engineering\u00a0Attacks**\n\n\nUsers can be exploited by immediately redirecting from a trusted domain to external malicious sites, taking advantage of user trust. This enables login page spoofing, credential harvesting, and redirection to malware distribution pages.\n\n**Authentication/Session\u00a0Flow Disruption**\n \n\nWhen users with valid sessions/cookies from the same origin click the link, they are redirected to unintended external domains, which can bypass or disrupt authentication/authorization flows. When combined with redirect-based flows like OAuth/OIDC, this can escalate into security incidents.",
  "id": "GHSA-rfh5-c9h5-q8jm",
  "modified": "2025-10-15T19:14:33Z",
  "published": "2025-10-15T17:56:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/reflex-dev/reflex/security/advisories/GHSA-rfh5-c9h5-q8jm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62379"
    },
    {
      "type": "WEB",
      "url": "https://github.com/reflex-dev/reflex/commit/ade12549f3c0ddab3d7382c581bc04a3c1f989ec"
    },
    {
      "type": "WEB",
      "url": "https://file.notion.so/f/f/d105d145-04bc-45c5-b46c-ed880895e9de/a86c3e3b-f67f-45d1-8fa2-4aa0ba7d0068/poc.mp4?table=block\u0026id=26955717-5d2e-805a-b53c-e25ee03f1d4b\u0026spaceId=d105d145-04bc-45c5-b46c-ed880895e9de\u0026expirationTimestamp=1760508000000\u0026signature=ZPp8PVldfGOh0gB5tVElRV6GN789R-EG0oxZgkFjjLU\u0026downloadName=poc.mp4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/reflex-dev/reflex"
    },
    {
      "type": "WEB",
      "url": "https://github.com/reflex-dev/reflex/blob/51f9f2c2f52cac4d66c07683a12bc0237311b6be/reflex/utils/codespaces.py#L18-L46"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "reflex-dev/reflex has an Open Redirect vulnerability"
}