{"id":"CVE-2025-61782","aliases":["PYSEC-2026-2264","GHSA-jc3f-c62g-v7qw"],"title":"OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redi…","summary":"OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callbac…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","vendor":"pycti","product":"pycti","ecosystem":"pip","affected":["pycti < 6.8.3"],"patched":["pycti 6.8.3"],"published":"2026-01-07","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/PYSEC-2026-2264","references":[{"url":"https://github.com/OpenCTI-Platform/opencti/releases/tag/6.8.3"},{"url":"https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-jc3f-c62g-v7qw"},{"url":"https://github.com/OpenCTI-Platform/opencti/commit/f755165a26888925c4a58018f7238ff92a0bd378"}],"tags":["osv","pip"],"epss":0.00259,"epssPercentile":0.17904,"ingestedAt":"2026-07-13T18:58:08.668Z","slug":"CVE-2025-61782","body":"## Overview\n\nOpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callback). By manipulating the RelayState parameter, an attacker can force the server to issue a 302 redirect to any external URL, enabling phishing, credential theft, and arbitrary site redirection. This issue has been patched in version 6.8.3.\n\n## Affected packages\n\n- `pycti < 6.8.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pycti 6.8.3`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}