{"id":"CVE-2025-65954","aliases":["GHSA-cvrm-5hp6-h523"],"url":"https://o3.security/vulnerability/CVE-2025-65954","summary":"SimpleSAMLphp-casserver  has an Open Redirect vulnerability via logout","details":"### Summary\n\nThe logout endpoint accepts a `url` query parameter to redirect to.  casserver treats that url as trusted, and either (depending on configuration) redirects the browser there, or shows a \"you've been logged out\" page with a link to continue to that url.\n\nThere are a number of other things broken with logout in 7 (cas v3 uses a different query parameters, etc)\n\n### Details\n\nhttps://github.com/simplesamlphp/simplesamlphp-module-casserver/blob/21418f7efbea8c4f078fd4a7d1b9eacf94dd4941/src/Controller/LogoutController.php#L104\n\nPrevious module checked the url against the valid service urls.\n\n### PoC\n\nThe docker instructions from the README.md run an image with a vulnerable config. \n\nAccessing  https://localhost/cas/logout?url=https://google.com  will redirect to Google\n\n### Impact\n\nImpacted configs have\n\n```php\n'enable_logout' => true,\n```\n\nand are most impacted if they also have\n\n```\n'skip_logout_page' -> true,\n```","published":"2026-05-18T19:57:07.228Z","modified":"2026-10-28T02:31:14.974146660Z","cvss":{"score":4.7,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"},"epss":{"score":0.00269,"percentile":0.1854,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"simplesamlphp/simplesamlphp-module-casserver","fixedVersion":"7.0.0"},{"ecosystem":"Packagist","name":"simplesamlphp/simplesamlphp-module-casserver","fixedVersion":"6.3.1"}],"fix":{"url":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/commit/0462f50f00b3bb300d83067d11b74146a57bb8e0","label":"simplesamlphp/simplesamlphp-module-casserver@0462f50"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65954.json"},{"type":"ADVISORY","url":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/security/advisories/GHSA-cvrm-5hp6-h523"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65954"},{"type":"FIX","url":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/commit/0462f50f00b3bb300d83067d11b74146a57bb8e0"},{"type":"FIX","url":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/commit/fb6c6f1c7b9e757c93c5c306e1d36405e64f6dc5"},{"type":"PACKAGE","url":"https://github.com/simplesamlphp/simplesamlphp-module-casserver"},{"type":"WEB","url":"https://github.com/simplesamlphp/simplesamlphp-module-casserver/blob/21418f7efbea8c4f078fd4a7d1b9eacf94dd4941/src/Controller/LogoutController.php#L104"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:14.974146660Z"}}