CVE-2025-65954

MediumCVSS 6.1

Published: 18/05/2026(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

17th percentile - higher than 17% of all known CVEs

Summary

SimpleSAMLphp-casserver versions below 6.3.1 and 7.0.0 treat the url query parameter in the logout endpoint as trusted, allowing redirection to arbitrary external domains. This affects configurations with 'enable_logout' and 'skip_logout_page' enabled.

Risk Assessment

An attacker can use a crafted link to redirect a user to a malicious site and conduct phishing attacks. This may lead to credential theft.

Recommendation

Update SimpleSAMLphp-casserver to version 6.3.1 or 7.0.0. If updating is not possible, consider disabling 'enable_logout' or 'skip_logout_page'.

Other vulnerabilities in SimpleSAMLphp-casserver

CVE-2026-46491High
SimpleSAMLphp-casserver before version 7.0.3 has a path traversal vulnerability in FileSystemTicketStore. An attacker can use ../ sequences in the ticket identifier to read and unserialize arbitrary files outside the ticket directory, and in CAS 1.0 also delete them.

Original NVD description (English source)

SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions below 6.3.1 and 7.0.0, the logout endpoint accepts a url query parameter to redirect to. casserver treats that url as trusted, and either (depending on configuration) redirects the browser there, or shows a "you've been logged out" page with a link to continue to that url. Impacted configs include 'enable_logout' => true, and 'skip_logout_page' -> true. This issue has been resolved in versions 6.3.1 and 7.0.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS