CVE-2025-65954CWE-601

CVE-2025-65954

Medium · published May 19, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
18.0
In the wild
Unconfirmed
What it is

SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions below 6.3.1 and 7.0.0, the logout endpoint accepts a url query parameter to redirect to. casserver treats that url as trusted, and either (depending on configuration) redirects the browser there, or shows a "you've been logged out" page with a link to continue to that url. Impacted configs include 'enable_logout' => true, and 'skip_logout_page' -> true. This issue has been resolved in versions 6.3.1 and 7.0.0.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00269 · 18.0th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-05-19T00:16Z
Affected products (3)
ProductVersionsFixed in
simplesamlphp/simplesamlphp-module-casserver< 6.3.16.3.1
simplesamlphp/simplesamlphp-module-casserverall versions—
simplesamlphp/simplesamlphp-module-casserverall versions—
References (4)
https://github.com/simplesamlphp/simplesamlphp-module-casserver/commit/0462f50f00b3bb300d83067d11b74146a57bb8e0 · [email protected]https://github.com/simplesamlphp/simplesamlphp-module-casserver/commit/fb6c6f1c7b9e757c93c5c306e1d36405e64f6dc5 · [email protected]https://github.com/simplesamlphp/simplesamlphp-module-casserver/security/advisories/GHSA-cvrm-5hp6-h523 · [email protected]https://github.com/simplesamlphp/simplesamlphp-module-casserver/security/advisories/GHSA-cvrm-5hp6-h523 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 MAY 19:57Z
    SimpleSAMLphp-casserver has an Open Redirect vulnerability via logout
    cvelistv5