ZeroDay Findings
Sign inSign up

Findings

CVE-2026-25477

AFFiNE is an open-source, all-in-one workspace and an operating system.

Published Mar 2, 2026 · updated Jun 17, 2026 · affine affine

AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.26.0, there is an Open Redirect vulnerability located at the /redirect-proxy endpoint. The flaw exists in the domain validation logic, where an improperly anchored Regular Expression allows an attacker to bypass the whitelist by using malicious domains that end with a trusted string. This issue has been patched in version 0.26.0.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 2, 2026 · NIST NVD

    Detected

    AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.26.0, there is an Open Redirect vulnerability located at the /redirect-proxy endpoint. The flaw exists in the domain validation logic, where an improperly anchored Regular Expression allows an attacker to bypass the whitelist by using malicious domains that end with a trusted string. This issue has been patc

  2. Jun 17, 2026 · NIST NVD

    Updated

    AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.26.0, there is an Open Redirect vulnerability located at the /redirect-proxy endpoint. The flaw exists in the domain validation logic, where an improperly anchored Regular Expression allows an attacker to bypass the whitelist by using malicious domains that end with a trusted string. This issue has been patc

Affected

  • cpe affine/affineversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-25477

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-25477

    AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.26.0, there is an Open Redirect vulnerability located at the /redirect-proxy endpoint. The flaw exists in the domain validation logic, where an improperly anchored Regular Expression allows

    nvd.nist.gov

References