The logout endpoint accepts a url query parameter to redirect to. casserver treats that url as trusted, and either (depending on configuration) redirects the browser there, or shows a "you've been logged out" page with a link to continue to that url.
There are a number of other things broken with logout in 7 (cas v3 uses a different query parameters, etc)
https://github.com/simplesamlphp/simplesamlphp-module-casserver/blob/21418f7efbea8c4f078fd4a7d1b9eacf94dd4941/src/Controller/LogoutController.php#L104
Previous module checked the url against the valid service urls.
The docker instructions from the README.md run an image with a vulnerable config.
Accessing https://localhost/cas/logout?url=https://google.com will redirect to Google
Impacted configs have
'enable_logout' => true,
and are most impacted if they also have
'skip_logout_page' -> true,
| Score | Percentile |
|---|---|
| 0.03% | 8.28% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 4.7 | 3.0 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-cvrm-5hp6-h523 ↗ |
| CVE | CVE-2025-65954 ↗ |
| CWE id | Name |
|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| composer | simplesamlphp/simplesamlphp-module-casserver | >= 7.0.0-rc1, < 7.0.0-rc3 | 7.0.0 | — |
| composer | simplesamlphp/simplesamlphp-module-casserver | < 6.3.1 | 6.3.1 | — |