AppFlowy-IO/AppFlowy

Fork 0

mirror of https://github.com/AppFlowy-IO/AppFlowy.git synced 2026-03-24 12:56:59 +00:00

[GH-ISSUE #8551] Open Redirect on SignUp Page #3896

New issue

Closed

opened 2026-03-23 21:33:57 +00:00 by mirror · 7 comments

mirror commented

2026-03-23 21:33:57 +00:00

Owner

Originally created by @Devilspo on GitHub (Mar 2, 2026).
Original GitHub issue: https://github.com/AppFlowy-IO/AppFlowy/issues/8551

Bug Description

The SignUp endpoint is vulnerable to an Open Redirect vulnerability.
An attacker can manipulate the redirectTo parameter to redirect users to an arbitrary external domain after signup.
This can be used for phishing attacks and social engineering by abusing the trusted domain.

How to Reproduce

Open the following URL in a browser: https://appflowy.com/login?redirectTo=https%3A%2F%2Fappflowy.com%2Fapp
Change the above URL into : https://appflowy.com/login?redirectTo=https%3A%2F%2Fevil.com and Enter
Complete the signup process (or trigger redirect if automatic).
Observe that the application redirects the user to: "http://evil.com/"

Expected Behavior

The application should validate the redirectTo (or redirect) parameter and ensure that users are only redirected to trusted internal pages after completing the signup process.

Operating System

Windows

AppFlowy Version(s)

https://appflowy.com

Screenshots

Additional Context

This vulnerability allows an attacker to redirect users from a trusted domain to a malicious external website.

Because the malicious link begins with the legitimate domain, users are more likely to trust and click it, significantly increasing the success rate of phishing attacks.

An attacker can use this issue to steal user credentials, distribute malware, or conduct large-scale social engineering campaigns.

The trusted domain reputation may help bypass email security filters and web protection mechanisms.

If combined with authentication flows or token-based mechanisms, this vulnerability could potentially lead to account takeover.

Overall, this issue increases the risk of phishing, brand abuse, and user compromise, posing a significant threat to both users and the organization’s reputation.

Originally created by @Devilspo on GitHub (Mar 2, 2026). Original GitHub issue: https://github.com/AppFlowy-IO/AppFlowy/issues/8551 ### Bug Description The SignUp endpoint is vulnerable to an Open Redirect vulnerability. An attacker can manipulate the redirectTo parameter to redirect users to an arbitrary external domain after signup. This can be used for phishing attacks and social engineering by abusing the trusted domain. ### How to Reproduce 1. Open the following URL in a browser: https://appflowy.com/login?redirectTo=https%3A%2F%2Fappflowy.com%2Fapp 2. Change the above URL into : https://appflowy.com/login?redirectTo=https%3A%2F%2Fevil.com and Enter 3. Complete the signup process (or trigger redirect if automatic). 4. Observe that the application redirects the user to: "http://evil.com/" ### Expected Behavior The application should validate the redirectTo (or redirect) parameter and ensure that users are only redirected to trusted internal pages after completing the signup process. ### Operating System Windows ### AppFlowy Version(s) https://appflowy.com ### Screenshots <img width="1632" height="810" alt="Image" src="https://github.com/user-attachments/assets/0a56b451-bcba-4c4f-9326-66fe9849efcb" /> <img width="1627" height="808" alt="Image" src="https://github.com/user-attachments/assets/dbe56120-f017-40ff-ac18-e26a33b9a1f3" /> <img width="1636" height="821" alt="Image" src="https://github.com/user-attachments/assets/2fa6ca6a-5f60-4127-90e9-c6c8ae375a37" /> <img width="1628" height="788" alt="Image" src="https://github.com/user-attachments/assets/d85c8aac-ba80-4ab4-958c-d232bb78b5fc" /> <img width="1643" height="801" alt="Image" src="https://github.com/user-attachments/assets/82b16755-350b-4c10-baa6-24d20b38916b" /> <img width="1632" height="827" alt="Image" src="https://github.com/user-attachments/assets/50c8a303-ce24-4834-a4b0-7e6272ea51dd" /> <img width="1622" height="810" alt="Image" src="https://github.com/user-attachments/assets/26e267f5-dd9c-424c-b6f2-4fe01402e5d0" /> ### Additional Context This vulnerability allows an attacker to redirect users from a trusted domain to a malicious external website. Because the malicious link begins with the legitimate domain, users are more likely to trust and click it, significantly increasing the success rate of phishing attacks. An attacker can use this issue to steal user credentials, distribute malware, or conduct large-scale social engineering campaigns. The trusted domain reputation may help bypass email security filters and web protection mechanisms. If combined with authentication flows or token-based mechanisms, this vulnerability could potentially lead to account takeover. Overall, this issue increases the risk of phishing, brand abuse, and user compromise, posing a significant threat to both users and the organization’s reputation.

mirror closed this issue

2026-03-23 21:33:57 +00:00

mirror commented

2026-03-23 21:33:58 +00:00

Author

Owner

@LucasXu0 commented on GitHub (Mar 3, 2026):

Thanks for reporting this. We’re working on a fix.

@LucasXu0 commented on GitHub (Mar 3, 2026): Thanks for reporting this. We’re working on a fix.

mirror commented

2026-03-23 21:33:58 +00:00

Author

Owner

@Devilspo commented on GitHub (Mar 4, 2026):

Any update

@Devilspo commented on GitHub (Mar 4, 2026): Any update

mirror commented

2026-03-23 21:33:58 +00:00

Author

Owner

@Arpit934823 commented on GitHub (Mar 6, 2026):

Hi, I'd like to work on this issue.

Could you clarify where the login/signup redirect logic is implemented?
Is it inside this repository or handled by the AppFlowy web service?

@Arpit934823 commented on GitHub (Mar 6, 2026): Hi, I'd like to work on this issue. Could you clarify where the login/signup redirect logic is implemented? Is it inside this repository or handled by the AppFlowy web service?

mirror commented

2026-03-23 21:33:58 +00:00

Author

Owner

@Devilspo commented on GitHub (Mar 10, 2026):

Hi, thank you for the clarification.

I investigated the issue further and found that the vulnerability occurs during the signup process, and it appears to be handled by the AppFlowy web service

@Devilspo commented on GitHub (Mar 10, 2026): Hi, thank you for the clarification. I investigated the issue further and found that the vulnerability occurs during the signup process, and it appears to be handled by the AppFlowy web service

mirror commented

2026-03-23 21:33:58 +00:00

Author

Owner

@Devilspo commented on GitHub (Mar 15, 2026):

Any update

@Devilspo commented on GitHub (Mar 15, 2026): Any update

mirror commented

2026-03-23 21:33:59 +00:00

Author

Owner

@Devilspo commented on GitHub (Mar 18, 2026):

Can I disclose this vulnerability?

@Devilspo commented on GitHub (Mar 18, 2026): Can I disclose this vulnerability?

mirror commented

2026-03-23 21:33:59 +00:00

Author

Owner

@annieappflowy commented on GitHub (Mar 19, 2026):

@Devilspo , we have fixed this issue and will release it soon. Thank you!

@annieappflowy commented on GitHub (Mar 19, 2026): @Devilspo , we have fixed this issue and will release it soon. Thank you!

mirror referenced this issue

2026-03-23 22:20:59 +00:00

[PR #3896] [MERGED] Update sv.json #5935