Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.20-alpha, the is_safe_url() helper used to validate post-login redirect targets applied urljoin(request.host_url, target) before parsing, while the controller passed the raw target to redirect(). A scheme-relative input such as ////evil.com resolved to a same-host URL during validation but was emitted verbatim in the Location header, where the browser interpreted it as a network-path-relative redirect to an attacker-controlled host. This vulnerability is fixed in 0.8.20-alpha.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-45307 Open Redirect Vulnerability in Speakr Prior to 0.8.20-alpha https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45307
Post summary
An open redirect issue in Speakr (pre‑0.8.20) has been disclosed via Vulmon, without additional technical or exploit details.
CVE-2026-45307 Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.20-alpha, the is_safe_url() helper used to validate post-lo… https://www.cve.org/CVERecord?id=CVE-2026-45307
Post summary
The post briefly references CVE-2026-45307 and a helper function issue in Speakr, but lacks details on exploitation, patching, or technical specifics.