Description
SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions below 6.3.1 and 7.0.0, the logout endpoint accepts a url query parameter to redirect to. casserver treats that url as trusted, and either (depending on configuration) redirects the browser there, or shows a -you-ve been logged out- page with a link to continue to that url. Impacted configs include -enable_logout- => true, and -skip_logout_page- -> true. This issue has been resolved in versions 6.3.1 and 7.0.0.
CVSS 4.7EPSS 0.269%Risk 0.48
View source- Published
- 2026-05-18 20:16:36
- Affected versions
- <6.3.1,<7.0.0
- Type
- Package
- Vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N