PT-2025-32264 · Openvpn+1 · Openvpn Access Server+1

Published 2025-08-07 · Updated 2025-12-26 · CVE-2025-50055

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenVPN Access Server (affected versions not specified)

Description The vulnerability allows an attacker to perform JavaScript injection via the SAML relaystate. This could potentially lead to Remote Code Execution (RCE).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-00317

CVE-2025-50055

Affected Products

Openvpn Access Server

Red Os

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-50055 · Security Note
• https://bdu.fstec.ru/vul/2026-00317 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-openvpn-cve-2025-50055-7.3 · Note
• https://twitter.com/Netlas_io/status/1953708020946329788 · Twitter Post
• https://reddit.com/r/AccessServer/comments/1mk23ko/access_server_300_release_notes_released_july_10 · Reddit Post
• https://t.me/netlas/458 · Telegram Post
• https://openvpn.net/as-docs/as-3-0-release-notes.html#access-server-3-0-release-notes-and-version-updates · Note
• https://openvpn.net/as-docs/as-3-0-release-notes.html#access-server-3-0-0 · Note
• https://t.me/CVEtracker/35846 · Telegram Post