CVE-2025-50055CWE-79cross-site-scripting

CVE-2025-50055

Medium · published October 27, 2025

CVSS v3.1
6.4
EPSS
0%
Percentile
11.2
In the wild
Unconfirmed
What it is

Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML Assertion Consumer Service (ACS) endpoint servers to inject arbitrary web script or HTML via the RelayState parameter

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00214 · 11.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-27T18:15Z
References (1)
https://openvpn.net/as-docs/as-3-0-release-notes.html#access-server-3-0-0 · [email protected]
EPSS history
Timeline
  • 27 OCT 13:39Z
    Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML…
    cvelistv5