CVE-2025-62379

🗓️ 15 Oct 2025 15:57:57Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 7 Views🌐 WEB

CVE-2025-62379 enables external redirects in Reflex /auth-codespace when Codespaces or forwarding domain is set; patched in 0.8.15.

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2025-62379	14 Oct 202523:48	–	circl
CNNVD	Reflex 输入验证错误漏洞	15 Oct 202500:00	–	cnnvd
Cvelist	CVE-2025-62379 Open Redirect in reflex-dev/reflex	15 Oct 202515:57	–	cvelist
EUVD	EUVD-2025-34684	15 Oct 202517:56	–	euvd
Github Security Blog	reflex-dev/reflex has an Open Redirect vulnerability	15 Oct 202517:56	–	github
NVD	CVE-2025-62379	15 Oct 202516:15	–	nvd
OSV	CVE-2025-62379 Open Redirect in reflex-dev/reflex	15 Oct 202515:57	–	osv
OSV	GHSA-RFH5-C9H5-Q8JM reflex-dev/reflex has an Open Redirect vulnerability	15 Oct 202517:56	–	osv
RedhatCVE	CVE-2025-62379	16 Oct 202516:01	–	redhatcve
Snyk	Open Redirect	15 Oct 202517:56	–	snyk

Vulners

Node

reflex-dev reflexRange0.5.4–0.8.15

[
  {
    "vendor": "reflex-dev",
    "product": "reflex",
    "versions": [
      {
        "version": ">= 0.5.4, < 0.8.15",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/reflex-dev/reflex/commit/ade12549f3c0ddab3d7382c581bc04a3c1f989ec
github	www.github.com/reflex-dev/reflex/security/advisories/GHSA-rfh5-c9h5-q8jm

Parameter	Position	Path	Description	CWE
redirect_to	query param	/auth-codespace	Endpoint assigns redirect_to query parameter directly to client-side link and triggers automatic navigation, enabling external redirects in certain environments.	CWE-601

15 Apr 2026 00:35Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.13.1

EPSS0.00059

SSVC

CWE-601