Read the docs
TI-2025-39566 Aliases CVE-2025-64115

Movary unvalidated Referer header allows open redirect and phishing

Priority LOW 23CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-601.

Summary

Movary is a web application to track, rate and explore your movie watch history. Versions up to and including 0.68.0 use the HTTP Referer header value directly for redirects in multiple settings endpoints, allowing a crafted link to cause an open redirect to an attacker-controlled site and facilitate phishing. This vulnerability is fixed in 0.69.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00255 17th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed movary (leepeuker): 0.69.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
leepeukermovarybefore 0.69.00.69.0Patch availableCNA
  • movary Vendorleepeuker Affected before 0.69.0 Fixed in 0.69.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:leepeuker:movary:*:*:*:*:*:*:*:*before 0.69.0Vulnerableleepeuker
  • cpe:2.3:a:leepeuker:movary:*:*:*:*:*:*:*:* Versions before 0.69.0 Vulnerable ·leepeuker

Remediation

  • Fix · CNA movary (leepeuker) Fixed in 0.69.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-64115

References

Exploit 1

Patch 1

Other 1

  • TI-2026-19203 Movary vulnerable to Cross-site Scripting with `?categoryDeleted=` param CVSS 3.1CRITICAL 9.3
  • TI-2026-19202 Movary vulnerable to Cross-site Scripting with `?categoryUpdated=` param CVSS 3.1CRITICAL 9.3
  • TI-2026-29125 Incorrect authorization in leepeuker movary CVSS 3.1HIGH 8.8
  • TI-2026-29124 Authenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=true CVSS 3.1HIGH 8.8
  • TI-2026-29123 Movary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing CVSS 3.1HIGH 7.7
  • TI-2025-39567 Movary vulnerable to an open redirect CVSS 4.0MEDIUM 5.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences