{"id":"CVE-2025-61782","title":"OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables","summary":"OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callbac…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cwe":["CWE-601"],"vendor":"citeum","product":"opencti","affected":["opencti < 6.8.3"],"patched":["opencti 6.8.3"],"published":"2026-01-07","updated":"2026-10-12","sourceUpdated":"2026-10-12T22:10:00.247","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-61782","references":[{"url":"https://github.com/OpenCTI-Platform/opencti/commit/f755165a26888925c4a58018f7238ff92a0bd378","label":"security-advisories@github.com"},{"url":"https://github.com/OpenCTI-Platform/opencti/releases/tag/6.8.3","label":"security-advisories@github.com"},{"url":"https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-jc3f-c62g-v7qw","label":"security-advisories@github.com"}],"tags":["nvd","osv","pip"],"epss":0.00256,"epssPercentile":0.17128,"aliases":["PYSEC-2026-2264","GHSA-jc3f-c62g-v7qw"],"ecosystem":"pip","scores":{"nvd":5.4,"osv":6.1},"ingestedAt":"2026-07-13T18:58:08.668Z","slug":"CVE-2025-61782","body":"## Overview\n\nOpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callback). By manipulating the RelayState parameter, an attacker can force the server to issue a 302 redirect to any external URL, enabling phishing, credential theft, and arbitrary site redirection. This issue has been patched in version 6.8.3.\n\n## Affected\n\n- `opencti < 6.8.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `opencti 6.8.3`\n\n## Package advisory (CVE-2025-61782)\n\nAffected packages:\n\n- `pycti < 6.8.3`\n\nPatched in:\n\n- `pycti 6.8.3`\n\nSource: https://osv.dev/vulnerability/PYSEC-2026-2264","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":215932,"id":"CVE-2025-61782","ts":1791221307151,"field":"cvss","old":"6.1","new":"5.4"}]}