CVE Explorer
CVE-2025-65954
SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions below 6.3.1 and 7.0.0, the logout endpoint accepts a url query parameter to redirect to. casserver treats that url as trusted, and either (depending on configuration) redirects the browser there, or shows a "you've been logged out" page with a link to continue to that url. Impacted configs include 'enable_logout' => true, and 'skip_logout_page' -> true. This issue has been resolve
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"simplesamlphp-module-casserver","vendor":"simplesamlphp","versions":[{"status":"affected","version":"< 6.3.1"},{"status":"affected","version":">= 7.0.0-rc1, < 7.0.0"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:18ecc90615420983b1f1ed341eb832eb688fc950f9496dfb563a1a909ef735be · sha256:dcb0783c037b0f3a… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","version":"3.0"},"metric_type":"cvssV3_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:18ecc90615420983b1f1ed341eb832eb688fc950f9496dfb563a1a909ef735be · sha256:dcb0783c037b0f3a… · /containers/cna/metrics/0/cvssV3_0
CWE assertions
1 source assertion{"cweId":"CWE-601","description":"CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:18ecc90615420983b1f1ed341eb832eb688fc950f9496dfb563a1a909ef735be · sha256:dcb0783c037b0f3a… · /containers/cna/problemTypes/0/descriptions/0
Source references
4 source assertions{"name":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/commit/0462f50f00b3bb300d83067d11b74146a57bb8e0","tags":["x_refsource_MISC"],"url":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/commit/0462f50f00b3bb300d83067d11b74146a57bb8e0"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:18ecc90615420983b1f1ed341eb832eb688fc950f9496dfb563a1a909ef735be · sha256:dcb0783c037b0f3a… · /containers/cna/references/1
{"name":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/commit/fb6c6f1c7b9e757c93c5c306e1d36405e64f6dc5","tags":["x_refsource_MISC"],"url":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/commit/fb6c6f1c7b9e757c93c5c306e1d36405e64f6dc5"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:18ecc90615420983b1f1ed341eb832eb688fc950f9496dfb563a1a909ef735be · sha256:dcb0783c037b0f3a… · /containers/cna/references/2
{"name":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/security/advisories/GHSA-cvrm-5hp6-h523","tags":["x_refsource_CONFIRM"],"url":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/security/advisories/GHSA-cvrm-5hp6-h523"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:18ecc90615420983b1f1ed341eb832eb688fc950f9496dfb563a1a909ef735be · sha256:dcb0783c037b0f3a… · /containers/cna/references/0
{"tags":["exploit"],"url":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/security/advisories/GHSA-cvrm-5hp6-h523"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:18ecc90615420983b1f1ed341eb832eb688fc950f9496dfb563a1a909ef735be · sha256:dcb0783c037b0f3a… · /containers/adp/0/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.