EUVD-2026-42532
GHSA-mhgm-6mc5-8v9j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector with no privileges required; UI:R because victim must initiate SSO; S:C because cache poisoning propagates impact to users beyond the initial attacker interaction; C:L reflects indirect credential exposure via phishing redirect.
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
Lifecycle Timeline
2DescriptionCVE.org
An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who subsequently initiate SAML Single Sign-On, enabling phishing and credential-theft attacks, as well as disrupting SAML authentication for all affected users.
AnalysisAI
Open Redirect via SAML SSO cache poisoning in Nozomi Networks Guardian and CMC allows unauthenticated remote attackers to corrupt the server-side redirect cache for all users by submitting a crafted request to the SAML sign-in endpoint with a malicious redirection parameter. Victims who subsequently initiate SAML Single Sign-On are transparently redirected to attacker-controlled infrastructure, enabling phishing and credential theft. The flaw additionally disrupts legitimate SAML authentication for affected users, introducing an availability dimension beyond the typical Open Redirect threat model. No active exploitation (KEV) or public exploit code has been identified at time of analysis.
Technical ContextAI
CWE-601 (URL Redirection to Untrusted Site) describes failures to validate or sanitize user-controlled destination parameters before using them in HTTP redirects. In SAML authentication flows, a RelayState or equivalent post-authentication redirect parameter is passed by the client and processed by the Service Provider to return the user to their intended destination after identity assertion. The critical flaw here is that this redirect value is cached server-side without sufficient validation after being supplied by an unauthenticated party, meaning the poisoned value persists and affects subsequent legitimate authentication attempts by other users - a cache-poisoning amplification pattern rather than a simple per-request redirect manipulation. Affected products per CPE: Nozomi Networks Guardian (cpe:2.3:a:nozomi_networks:guardian:*:*:*:*:*:*:*:*) and Nozomi Networks CMC (cpe:2.3:a:nozomi_networks:cmc:*:*:*:*:*:*:*:*), both with wildcard version entries indicating all tracked versions are considered affected. Guardian and CMC are OT/ICS network visibility and security monitoring platforms, making SAML SSO a common enterprise integration point.
RemediationAI
Consult the Nozomi Networks security advisory NN-2026:9-01 at https://security.nozominetworks.com/NN-2026:9-01 for the official fixed version and upgrade instructions. An exact patched version number is not confirmed in currently available data and should not be assumed. As an interim compensating control, disabling SAML Single Sign-On on Guardian and CMC instances and reverting to local or alternative authentication removes the attack surface entirely, at the cost of disrupting federated identity workflows and potentially requiring credential management for each appliance individually. If SAML SSO cannot be disabled, restricting network-layer access to the SAML sign-in endpoint to trusted IP ranges (e.g., internal IdP callback addresses only) reduces exposure to external attackers, though it does not protect against insider threats or compromised internal hosts. Monitoring authentication logs for anomalous redirect targets can serve as a detection measure while a patch is applied.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today