---
id: CVE-2025-61782
title: >-
  OpenCTI is an open source platform for managing cyber threat intelligence
  knowledge and observables
summary: >-
  OpenCTI is an open source platform for managing cyber threat intelligence
  knowledge and observables. Prior to version 6.8.3, an open redirect
  vulnerability exists in the OpenCTI platform's SAML authentication endpoint
  (/auth/saml/callbac…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'
cwe:
  - CWE-601
vendor: citeum
product: opencti
affected:
  - opencti < 6.8.3
patched:
  - opencti 6.8.3
published: '2026-01-07'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T22:10:00.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-61782'
references:
  - url: >-
      https://github.com/OpenCTI-Platform/opencti/commit/f755165a26888925c4a58018f7238ff92a0bd378
    label: security-advisories@github.com
  - url: 'https://github.com/OpenCTI-Platform/opencti/releases/tag/6.8.3'
    label: security-advisories@github.com
  - url: >-
      https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-jc3f-c62g-v7qw
    label: security-advisories@github.com
tags:
  - nvd
  - osv
  - pip
epss: 0.00256
epssPercentile: 0.17128
aliases:
  - PYSEC-2026-2264
  - GHSA-jc3f-c62g-v7qw
ecosystem: pip
scores:
  nvd: 5.4
  osv: 6.1
ingestedAt: '2026-07-13T18:58:08.668Z'
---

## Overview

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callback). By manipulating the RelayState parameter, an attacker can force the server to issue a 302 redirect to any external URL, enabling phishing, credential theft, and arbitrary site redirection. This issue has been patched in version 6.8.3.

## Affected

- `opencti < 6.8.3`

## Remediation

Upgrade past the affected range:

- `opencti 6.8.3`

## Package advisory (CVE-2025-61782)

Affected packages:

- `pycti < 6.8.3`

Patched in:

- `pycti 6.8.3`

Source: https://osv.dev/vulnerability/PYSEC-2026-2264