PT-2026-41385 · Packagist · Simplesamlphp/Simplesamlphp-Module-Casserver

Published 2026-05-15 · Updated 2026-05-15 · CVE-2025-65954

OSV

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Summary

The logout endpoint accepts a url query parameter to redirect to. casserver treats that url as trusted, and either (depending on configuration) redirects the browser there, or shows a "you've been logged out" page with a link to continue to that url.

There are a number of other things broken with logout in 7 (cas v3 uses a different query parameters, etc)

Details

https://github.com/simplesamlphp/simplesamlphp-module-casserver/blob/21418f7efbea8c4f078fd4a7d1b9eacf94dd4941/src/Controller/LogoutController.php#L104

Previous module checked the url against the valid service urls.

PoC

The docker instructions from the README.md run an image with a vulnerable config.

Accessing https://localhost/cas/logout?url=https://google.com will redirect to Google

Impact

Impacted configs have

'enable logout' => true,

and are most impacted if they also have

'skip logout page' -> true,

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-65954

GHSA-CVRM-5HP6-H523

Affected Products

Simplesamlphp/Simplesamlphp-Module-Casserver

References · 4

• https://osv.dev/vulnerability/GHSA-cvrm-5hp6-h523 · Vendor Advisory
• https://github.com/simplesamlphp/simplesamlphp-module-casserver · Note
• https://github.com/simplesamlphp/simplesamlphp-module-casserver/blob/21418f7efbea8c4f078fd4a7d1b9eacf94dd4941/src/Controller/LogoutController.php#L104 · Note
• https://github.com/simplesamlphp/simplesamlphp-module-casserver/security/advisories/GHSA-cvrm-5hp6-h523 · Note