CVE-2025-50055
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-27

Last updated on: 2025-10-30

Assigner: OpenVPN Inc.

Description
Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML Assertion Consumer Service (ACS) endpoint servers to inject arbitrary web script or HTML via the RelayState parameter
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-27
Last Modified
2025-10-30
Generated
2026-06-16
AI Q&A
2025-10-27
EPSS Evaluated
2026-06-15
NVD
CVE-2025-50055
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
openvpn access_server 3.0
openvpn access_server 3.0.1
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-site scripting (XSS) issue in the SAML Authentication module of OpenVPN Access Server versions 2.14.0 through 2.14.3. It allows remote SAML Assertion Consumer Service (ACS) endpoint servers, which are configured, to inject arbitrary web scripts or HTML code via the RelayState parameter.

Impact Analysis

This vulnerability can allow attackers controlling a configured remote SAML ACS endpoint to execute arbitrary scripts in the context of the OpenVPN Access Server web interface. This could lead to theft of user credentials, session hijacking, or other malicious actions performed on behalf of the user.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-50055. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart