Open Redirect in SAML Single Sign-On Functionality

Executive Summary

CVE-2026-31982 is an Open Redirect vulnerability found in the SAML Single Sign-On functionality of Guardian and CMC software versions before 26.2.0.

The vulnerability occurs because the software does not properly validate a user-controlled redirection parameter. This allows an unauthenticated attacker to craft a malicious request to the SAML sign-in endpoint.

By exploiting this, the attacker can poison the cached SAML redirection for other users who later initiate SAML Single Sign-On.

This can lead to phishing and credential-theft attacks, as well as disruption of SAML authentication for all affected users.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by enabling attackers to perform phishing and credential-theft attacks against users of the affected software.

Additionally, it can disrupt the SAML authentication process for all users relying on the affected SAML Single Sign-On functionality.

Such disruptions and attacks can compromise user credentials and reduce the overall security and availability of the authentication system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the Open Redirect vulnerability in the SAML Single Sign-On functionality, users are advised to upgrade the Guardian and CMC software to version 26.2.0 or later.

Alternatively, internal firewall features can be used to restrict access to the web management interface, reducing the risk of exploitation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an unauthenticated attacker to poison cached SAML redirections, enabling phishing and credential-theft attacks, as well as disrupting SAML authentication for users.

Such security weaknesses can potentially lead to unauthorized access to sensitive user data and compromise authentication mechanisms, which may impact compliance with standards and regulations like GDPR and HIPAA that require protection of personal and health information.

However, the provided information does not explicitly describe the direct effects on compliance with these standards or any regulatory implications.

Useful 0 Not Useful 0