What is the CVSS score of EUVD-2025-209889?

EUVD-2025-209889 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2025-209889?

Yes, a patch is available for EUVD-2025-209889. Update the affected software to the latest version immediately.

SimpleSAMLphp casserver EUVD-2025-209889

| CVE-2025-65954 MEDIUM

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-05-15 https://github.com/simplesamlphp/simplesamlphp-module-casserver

GHSA-cvrm-5hp6-h523

PHP Docker Google Open Redirect

6.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

May 21, 2026 - 21:07 NVD

4.7 (MEDIUM) 6.1 (MEDIUM)

Source Code Evidence Fetched

May 15, 2026 - 17:00 vuln.today

Analysis Generated

May 15, 2026 - 17:00 vuln.today

DescriptionGitHub Advisory

Summary

The logout endpoint accepts a url query parameter to redirect to. casserver treats that url as trusted, and either (depending on configuration) redirects the browser there, or shows a "you've been logged out" page with a link to continue to that url.

There are a number of other things broken with logout in 7 (cas v3 uses a different query parameters, etc)

Details

https://github.com/simplesamlphp/simplesamlphp-module-casserver/blob/21418f7efbea8c4f078fd4a7d1b9eacf94dd4941/src/Controller/LogoutController.php#L104

Previous module checked the url against the valid service urls.

PoC

The docker instructions from the README.md run an image with a vulnerable config.

Accessing https://localhost/cas/logout?url=https://google.com will redirect to Google

Impact

Impacted configs have

php

'enable_logout' => true,

and are most impacted if they also have

'skip_logout_page' -> true,

AnalysisAI

Open redirect in SimpleSAMLphp casserver module allows remote attackers to redirect authenticated users to arbitrary external domains after logout. Versions prior to 6.3.1 and 7.0.0-rc1 through 7.0.0-rc2 are affected. The logout endpoint accepts an unchecked 'url' query parameter without validating it against configured service URLs, enabling phishing attacks that leverage the trusted SimpleSAML domain. Public exploit code exists (POC: YES). EPSS data not available, but exploitation requires only user interaction (no authentication), making this readily exploitable in phishing campaigns targeting SSO users.

Technical ContextAI

SimpleSAMLphp casserver is a PHP module implementing CAS (Central Authentication Service) server functionality for federated single sign-on environments. The vulnerability exists in the LogoutController.php at line 104, where the logout endpoint processes the 'url' query parameter without validation. Previous versions of the module correctly validated redirect URLs against a whitelist of registered service URLs, but version 7.x removed this check. This is classified as CWE-601 (URL Redirection to Untrusted Site), commonly called an open redirect. The flaw violates the CAS protocol's security model, which requires service URL validation to prevent session riding and phishing attacks. When 'enable_logout' is true and especially when 'skip_logout_page' is also true, the module either directly redirects users or displays a logout confirmation page with an unvalidated link, both creating phishing vectors.

RemediationAI

Upgrade to SimpleSAMLphp casserver module version 6.3.1 for the 6.x series or version 7.0.0 for the 7.x series, both released by the vendor with fixes that restore URL validation against configured service URLs. Installation via Composer: composer update simplesamlphp/simplesamlphp-module-casserver. Until patching is complete, set 'enable_logout' => false in casserver configuration to disable the vulnerable logout endpoint entirely, though this eliminates Single Logout (SLO) functionality and may disrupt user workflows in federated environments. Alternative compensating control: set 'skip_logout_page' => false (default) to force display of logout confirmation page rather than automatic redirect, reducing but not eliminating phishing risk since malicious links remain clickable. Implement web application firewall (WAF) rules to inspect and block logout requests with 'url' parameters pointing to non-whitelisted domains, though this requires maintaining an accurate service URL whitelist and may break legitimate federated logout flows. Monitor authentication logs for suspicious logout patterns with external redirect targets. Advisory and patch details: https://github.com/simplesamlphp/simplesamlphp-module-casserver/security/advisories/GHSA-cvrm-5hp6-h523.