CVE-2025-65954: SimpleSAMLphp-casserver has an Open Redirect vulnerability via logout
Summary
The logout endpoint accepts a url query parameter to redirect to. casserver treats that url as trusted, and either (depending on configuration) redirects the browser there, or shows a "you've been logged out" page with a link to continue to that url.
There are a number of other things broken with logout in 7 (cas v3 uses a different query parameters, etc)
Details
https://github.com/simplesamlphp/simplesamlphp-module-casserver/blob/21418f7efbea8c4f078fd4a7d1b9eacf94dd4941/src/Controller/LogoutController.php#L104
Previous module checked the url against the valid service urls.
PoC
The docker instructions from the README.md run an image with a vulnerable config.
Accessing https://localhost/cas/logout?url=https://google.com will redirect to Google
Impact
Impacted configs have
php 'enablelogout' => true,
and are most impacted if they also have
'skiplogoutpage' -> true,
Other sources
SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions below 6.3.1 and 7.0.0, the logout endpoint accepts a url query parameter to redirect to. casserver treats that url as trusted, and either (depending on configuration) redirects the browser there, or shows a "you've been logged out" page with a link to continue to that url. Impacted configs include 'enablelogout' => true, and 'skiplogoutpage' -> true. This issue has been resolved in versions 6.3.1 and 7.0.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65954?
CVE-2025-65954 has been classified with a high severity due to its potential for open redirection attacks.
How do I fix CVE-2025-65954?
To fix CVE-2025-65954, upgrade to versions 6.3.1 or 7.0.0 of the simplesamlphp-module-casserver package.
What impact does CVE-2025-65954 have on user security?
CVE-2025-65954 can allow attackers to redirect users to malicious sites post-logout, posing a risk of phishing and data theft.
Can CVE-2025-65954 be exploited remotely?
Yes, CVE-2025-65954 can be exploited remotely by tricking users into clicking on crafted logout links.
Is user authentication affected by CVE-2025-65954?
User authentication remains intact, but the vulnerability may compromise the safety of the user's session during the logout process.