OpenVPN Access Server CVE-2025-50055

Requires that SAML SSO authentication is configured on OpenVPN Access Server and that the attacker controls or can manipulate a configured remote SAML ACS endpoint server - the trusted party permitted to return SAML responses including the RelayState parameter. Only versions 2.14.0 through 2.14.3 are affected, so running an unaffected version eliminates exposure. Exploitation is limited by this pre-existing SAML trust configuration (not available to arbitrary unauthenticated internet attackers, consistent with PR:L) and by the fact that a victim must complete an authentication flow for the reflected payload to execute; deployments not using SAML authentication are not exposed.

This is a moderate-severity reflected/stored XSS (CWE-79, CVSS 6.4) with a realistic risk profile well below a top priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates network reach, low complexity, scope change (script executing outside the vulnerable component in a victim's browser context) and only low confidentiality/integrity impact with no availability impact. The critical mitigating signal, however, is PR:L combined with the description's qualifier that only a 'configured remote SAML Assertion Consumer Service (ACS) endpoint server' can inject the payload - exploitation presupposes a trust relationship already established in the SAML configuration, not an arbitrary internet attacker. EPSS is low at 0.21% (11th percentile), there is no CISA KEV listing and no public exploit identified, which is consistent with a low likelihood of opportunistic, widespread exploitation. One signal to verify: the input CVSS uses UI:N, yet XSS typically depends on a victim's browser rendering the injected RelayState during the SSO flow - the 'no user interaction' choice is defensible for an auto-submitted SAML redirect but worth confirming with the vendor. Overall this is a genuine but bounded flaw: prioritize patching where SAML SSO is enabled, but it does not warrant emergency treatment absent exploitation evidence.

An actor controlling or able to influence a configured SAML ACS endpoint crafts a malicious RelayState value containing HTML/JavaScript. When a user authenticates through the affected OpenVPN Access Server (2.14.0-2.14.3) SAML flow, the unsanitized RelayState is reflected and the script executes in the user's browser in the Access Server's context, enabling session/credential theft or UI manipulation. No public exploit code has been identified at time of analysis, and the low attack complexity means a motivated, already-configured ACS operator could trigger it reliably.