CVE-2025-65954Medium· 6.1▾ SunlitSimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions below 6.3.1 and 7.0.0, the logout endpoint accepts a url query parameter to redirect to. casserver treats that url as tr…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions below 6.3.1 and 7.0.0, the logout endpoint accepts a url query parameter to redirect to. casserver treats that url as trusted, and either (depending on configuration) redirects the browser there, or shows a "you've been logged out" page with a link to continue to that url. Impacted configs include 'enable_logout' => true, and 'skip_logout_page' -> true. This issue has been resolved in versions 6.3.1 and 7.0.0.
simplesamlphp-module-casserver < 6.3.1simplesamlphp-module-casserver = 7.0.0Upgrade past the affected range:
simplesamlphp-module-casserver 6.3.1Connected by shared product, vendor, weakness, or advisory.
CVE-2024-0953Medium· 6.1When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the code
CVE-2026-34442Medium· 5.4FreeScout is a free help desk and shared inbox built with PHP's Laravel framework
CVE-2025-3155High· 7.4A flaw was found in Yelp
CVE-2026-49284High· 7.1SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`
CVE-2026-49283High· 8.7The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality
CVE-2026-49289High· 7.5The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality