Medium severity · published Oct 30, 2025
CVE-2025-64115
Movary unvalidated Referer header allows open redirect and phishing
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
Movary is a web application to track, rate and explore your movie watch history. Versions up to and including 0.68.0 use the HTTP Referer header value directly for redirects in multiple settings endpoints, allowing a crafted link to cause an open redirect to an attacker-controlled site and facilitate phishing. This vulnerability is fixed in 0.69.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
movary · leepeuker
< 0.69.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-64115
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-64115
Patch
https://github.com/leepeuker/movary/commit/716f703b4464ffdb0365c406f3660d275495769f
Issue Tracking
https://github.com/leepeuker/movary/pull/713
Exploit
https://github.com/leepeuker/movary/security/advisories/GHSA-pm58-79jw-q79f
More from movary
8.8
CVE-2026-40350
Movary User Management (/settings/users) has Authorization Bypass that Allows Low-Privileged Users to Enumerate All Users and Create Administrator Accounts
8.8
CVE-2026-40349
Authenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=true
7.7
CVE-2026-40348
Movary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing
6.1
CVE-2026-23841
Movary vulnerable to Cross-site Scripting with `?categoryCreated=` param
6.1
CVE-2026-23840
Movary vulnerable to Cross-site Scripting with `?categoryDeleted=` param