Detections
Analytics

Shibboleth SSO Open Redirect

medium Web App Scanning Plugin ID 115106

Synopsis

Shibboleth SSO Open Redirect

Description

Shibboleth Service Provider (SP) contains an open redirect vulnerability. An attacker can exploit this vulnerability to redirect users to malicious websites, potentially leading to phishing attacks or other malicious activities. This issue arises when the 'redirectLimit' configuration option is not properly set.

Solution

Configure the 'redirectLimit' option in the Shibboleth Service Provider configuration to prevents the injection of redirect locations.

See Also

https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334342/Sessions

Plugin Details

Severity: Medium

ID: 115106

Type: remote

Published: 1/15/2026

Updated: 1/15/2026

Scan Template: basic, full, pci, scan

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS Score Source: Tenable

Vulnerability Information

CPE: cpe:2.3:a:shibboleth:service_provider:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Reference Information