Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions below 6.3.1 and 7.0.0, the logout endpoint accepts a url query parameter to redirect to. casserver treats that url as trusted, and either (depending on configuration) redirects the browser there, or shows a "you've been logged out" page with a link to continue to that url. Impacted configs include 'enable_logout' => true, and 'skip_logout_page' -> true. This issue has been resolved in versions 6.3.1 and 7.0.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-05-19 | 2 | Disclosure2 |
| 2026-05-27 | 1 | Disclosure1 |
🟠 SimpleSAMLphp-casserver, Open Redirect, #CVE-2025-65954 (Medium) https://dailycve.com/simplesamlphp-casserver-open-redirect-cve-2025-65954-medium/
Post summary
The text announces CVE‑2025‑65954 as an open‑redirect issue in SimpleSAMLphp‑casserver with a Medium severity rating, without providing further exploitation or mitigation details.
🚨*CVE* CVE-2025-65954 SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions below 6.3.1 and 7.0.0, the logout endpoint accept… https://www.cve.org/CVERecord?id=CVE-2025-65954 ----- Traducción: CVE-2025-65954 Sim… http://infoflow.cloud`
Post summary
The text announces CVE‑2025‑65954, a logout‑endpoint vulnerability in SimpleSAMLphp‑casserver affecting versions below 6.3.1 and 7.0.0, but does not provide PoC, exploit, or mitigation details.
CVE-2025-65954 SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions below 6.3.1 and 7.0.0, the logout endpoint accept… https://www.cve.org/CVERecord?id=CVE-2025-65954
Post summary
CVE-2025-65954 is a disclosure about a vulnerability in the SimpleSAMLphp-casserver logout endpoint affecting versions below 6.3.1 and 7.0.0. No PoC, exploit code, active exploitation, patch, or false‑positive claim is presented.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | simplesamlphp | simplesamlphp-module-casserver | - | - | - |
| App | simplesamlphp | simplesamlphp-module-casserver | 7.0.0 | - | - |
| App | simplesamlphp | simplesamlphp-module-casserver | 7.0.0 | - | - |