OpenCTI up to 6.8.2 SAML Authentication Endpoint /auth/saml/callback RelayState redirect

Summaryinfo

A vulnerability identified as problematic has been detected in OpenCTI up to 6.8.2. This issue affects some unknown processing of the file /auth/saml/callback of the component SAML Authentication Endpoint. Performing a manipulation of the argument RelayState results in redirect. This vulnerability is known as CVE-2025-61782. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in OpenCTI up to 6.8.2. This affects some unknown functionality of the file /auth/saml/callback of the component SAML Authentication Endpoint. The manipulation of the argument RelayState with an unknown input leads to a redirect vulnerability. CWE is classifying the issue as CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. This is going to have an impact on integrity. The summary by CVE is:

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callback). By manipulating the RelayState parameter, an attacker can force the server to issue a 302 redirect to any external URL, enabling phishing, credential theft, and arbitrary site redirection. This issue has been patched in version 6.8.3.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-61782 since 09/30/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1204.001 according to MITRE ATT&CK.

Upgrading to version 6.8.3 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch f755165a26888925c4a58018f7238ff92a0bd378 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-0046). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Open Source OpenCTI

Productinfo

Name

• OpenCTI

Version

• 6.8.0
• 6.8.1
• 6.8.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion