CVE-2026-25477

CVE-2026-25477 is an Open Redirect vulnerability in AFFiNE, an open-source workspace, affecting versions prior to 0.26.0. The flaw, located at the /redirect-proxy endpoint, stems from an improperly anchored regular expression in the domain validation logic, allowing attackers to bypass the whitelist with malicious domains ending in a trusted string. With a CVSS score of 6.9 (Medium), this vulnerability has a network attack vector and low attack complexity, requiring user interaction to exploit, and could lead to high confidentiality impact. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.