---
id: CVE-2025-61782
aliases:
  - PYSEC-2026-2264
  - GHSA-jc3f-c62g-v7qw
title: >-
  OpenCTI is an open source platform for managing cyber threat intelligence
  knowledge and observables. Prior to version 6.8.3, an open redi…
summary: >-
  OpenCTI is an open source platform for managing cyber threat intelligence
  knowledge and observables. Prior to version 6.8.3, an open redirect
  vulnerability exists in the OpenCTI platform's SAML authentication endpoint
  (/auth/saml/callbac…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: pycti
product: pycti
ecosystem: pip
affected:
  - pycti < 6.8.3
patched:
  - pycti 6.8.3
published: '2026-01-07'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/PYSEC-2026-2264'
references:
  - url: 'https://github.com/OpenCTI-Platform/opencti/releases/tag/6.8.3'
  - url: >-
      https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-jc3f-c62g-v7qw
  - url: >-
      https://github.com/OpenCTI-Platform/opencti/commit/f755165a26888925c4a58018f7238ff92a0bd378
tags:
  - osv
  - pip
epss: 0.00259
epssPercentile: 0.1564
ingestedAt: '2026-07-13T18:58:08.668Z'
---

## Overview

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callback). By manipulating the RelayState parameter, an attacker can force the server to issue a 302 redirect to any external URL, enabling phishing, credential theft, and arbitrary site redirection. This issue has been patched in version 6.8.3.

## Affected packages

- `pycti < 6.8.3`

## Remediation

Upgrade to a patched release:

- `pycti 6.8.3`