CVE-2025-64116

Movary is a web application to track, rate and explore your movie watch history. Prior to 0.69.0, the login page accepts a redirect parameter without validation, allowing attackers to redirect authenticated users to arbitrary external sites. This vulnerability is fixed in 0.69.0.
Open Redirect
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GitHub_MCNA
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 10%
VendorProductVersion
leepeukermovary
𝑥
< 0.69.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/leepeuker/movary/commit/716f703b4464ffdb0365c406f3660d275495769f
https://github.com/leepeuker/movary/pull/713
https://github.com/leepeuker/movary/security/advisories/GHSA-7q72-x26x-7f8g
https://github.com/leepeuker/movary/security/advisories/GHSA-7q72-x26x-7f8g