Arista CloudVision CVE-2026-101152

Exploitation requires the target organization to use Arista CloudVision with SSO configured, and the attacker must induce a legitimate user to click a specially crafted login URL (UI:P) that the vulnerable SSO flow fails to validate, redirecting IdP-issued authentication material to an attacker-controlled URL. Limiting factors: no authentication is needed by the attacker (PR:N) but success depends on victim interaction, the presence and specific configuration of the SSO/IdP integration, and the high complexity/attack requirements (AC:H/AT:P) of producing a redirect accepted by the deployment. It does not affect CloudVision instances that do not use the SSO login flow.

This is a CWE-601 open redirect in the SSO login flow of Arista CloudVision, vendor-rated CVSS 4.0 7.6 (High). The CVSS 4.0 vector tells a consistent story with the description: network reachable (AV:N) but non-trivial to pull off - high attack complexity (AC:H), a present attack requirement (AT:P), and mandatory user interaction (UI:P, the victim must click the crafted URL). Critically, PR:N confirms the attacker needs no authentication, and VC:H/VI:H reflect that captured authentication material enables impersonation/session takeover of the victim's CloudVision access. No EPSS score, KEV listing, or POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is latent rather than imminent. The combination of AC:H + AT:P + UI:P materially lowers real-world exploitability versus the 7.6 headline: an attacker must both craft a valid redirect against a specific IdP/CloudVision SSO configuration and socially engineer a legitimate user into clicking. This is a credible targeted phishing-grade credential/token theft issue for organizations using Arista CloudVision SSO, but it is not a wormable, drive-by, or mass-exploitation bug. No conflicting signals were found between the CVSS vector and the description; both point to interaction-dependent, unauthenticated open redirect.

An attacker crafts a malicious SSO login URL for an organization's Arista CloudVision deployment that abuses insufficient redirect validation, then phishes a legitimate user into clicking it. When the user authenticates, the identity provider delivers the authentication material (token/assertion) to the attacker-controlled URL instead of CloudVision, letting the attacker hijack the session or impersonate the user. No public POC is identified at time of analysis, and success depends on the victim clicking (UI:P) and the specific SSO configuration (AC:H/AT:P).