Threats affecting pkg:github/murtaza-nasir/speakr

CVE-2026-54510 is an improper authentication vulnerability in murtaza-nasir speakr, a self-hosted transcription web app. Versions prior to 0.8.21-alpha allow an attacker to bypass CSRF protection by sending a crafted token in a query parameter, which disables CSRF checks for the targeted view during the worker lifetime. This can lead to unauthorized modifications of user profile data, settings, and administrative status. Additionally, the change_password route can be abused to set a local password on SSO-only accounts without verifying the current password. The issue is fixed in version 0.8.21-alpha.

Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.20-alpha, the is_safe_url() helper used to validate post-login redirect targets applied urljoin(request.host_url, target) before parsing, while the controller passed the raw target to redirect(). A scheme-relative input such as ////evil.com resolved to a same-host URL during validation but was emitted verbatim in the Location header, where the browser interpreted it as a network-path-relative redirect to an attacker-controlled host. This vulnerability is fixed in 0.8.20-alpha.