Redirect Vulnerability in Reflex Library for Full-Stack Web Apps

CVE-2025-62379

What is CVE-2025-62379?

The Reflex library, utilized for building full-stack web applications in Python, contains a vulnerability that affects versions 0.5.4 through 0.8.14. This issue is found at the /auth-codespace endpoint, which improperly assigns the redirect_to query parameter directly to client-side links without performing necessary validations. When triggered in a GitHub Codespaces environment, this flaw allows unauthorized redirection to arbitrary external URLs through automatic clicks upon page load. The impact is exacerbated as this vulnerable behavior can also be activated in production settings when the GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN environment variable is set. Thus, the vulnerability can expose users to potential phishing threats and unauthorized access to malicious external sites. The issue was corrected in version 0.8.15, and users are advised to avoid setting the environment variable in production contexts as an interim measure.

References