Affine · Affine · CVE-2026-25477
**Name of the Vulnerable Software and Affected Versions**
AFFiNE versions prior to 0.26.0
**Description**
AFFiNE, an open-source workspace and operating system, contains an Open Redirect flaw in the `/redirect-proxy` endpoint. The issue stems from a flawed domain validation process, where a Regular Expression lacking proper anchoring allows attackers to circumvent the domain whitelist by utilizing malicious domains that conclude with a trusted string.
**Recommendations**
Update to version 0.26.0 or later.