N/A

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-3jp4-mhh4-gcgr

GHSA-3jp4-mhh4-gcgr: Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS Handler

Summary

The SAML authentication success handler in Kimai returns the RelayState POST parameter as a redirect destination without validating the host or scheme. After a user successfully authenticates via SAML, they are redirected to an attacker-controlled URL if the IdP includes a malicious RelayState value. This enables phishing attacks that steal credentials or session tokens post-SSO.

Requires SAML to be enabled (non-default configuration).

Details

Vulnerable file: src/Saml/Security/SamlAuthenticationSuccessHandler.php

// Line 27-33
$relayState = $request->request->get('RelayState', $request->query->get('RelayState'));
if (\is_scalar($relayState)) {
    $relayState = (string) $relayState;
    if ($relayState !== $this->httpUtils->generateUri($request, (string) $this->options['login_path'])) {
        return $relayState;  // No host/scheme validation — any URL accepted
    }
}

The only check is that RelayState does not equal the configured login_path. Any external URL (e.g., https://attacker.com) passes this check and is returned as the redirect destination.

The existing unit test SamlAuthenticationSuccessHandlerTest::testRelayState() confirms this behavior — an absolute URL in RelayState results in a redirect to that URL with no restriction.

Steps to Reproduce

1. Enable SAML authentication in Kimai
2. Configure a SAML IdP (e.g., SimpleSAMLphp)
3. Initiate IdP-initiated SSO with RelayState=https://attacker.com
   — or intercept the ACS POST and modify RelayState to https://attacker.com
4. Complete SAML authentication at the IdP
5. Observe: after the SAMLResponse POST to /saml/acs, Kimai issues:
   HTTP/1.1 302 Found
   Location: https://attacker.com

Code-confirmed via unit test (testRelayState): onAuthenticationSuccess with RelayState=http://localhost/relayed redirects directly to that URL. External URLs follow the same code path.

Miggo Vulnerability Database

→

GHSA-3jp4-mhh4-gcgr

GHSA-3jp4-mhh4-gcgr:

N/A

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
kimai/kimai	composer	<= 2.52.0	2.53.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an open redirect in the SAML authentication handler. The onAuthenticationSuccess method in src/Saml/Security/SamlAuthenticationSuccessHandler.php processes the RelayState parameter. Before the patch, the code only checked if the RelayState was different from the login path, but it did not validate the host or scheme of the URL. This allowed an attacker to provide an external URL in the RelayState, which the application would then use for redirection. The patch fixes this by adding validation to ensure that the RelayState is a safe URL. Specifically, it checks that if a host is provided, it matches the application's host, and it disallows URLs with a scheme or that start with //. The vulnerable function is clearly onAuthenticationSuccess as it is the one handling the untrusted RelayState input and performing the redirect.

Vulnerable functions

Kimai\Saml\Security\SamlAuthenticationSuccessHandler::onAuthenticationSuccess

src/Saml/Security/SamlAuthenticationSuccessHandler.php

The `onAuthenticationSuccess` function in `SamlAuthenticationSuccessHandler.php` is vulnerable to an open redirect. It processes the `RelayState` parameter from the SAML authentication response without properly validating it. An attacker can set the `RelayState` to an external URL, and the application will redirect the user to that URL after successful authentication. The patch adds validation to ensure that the `RelayState` is a local path or a URL belonging to the same host.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-3jp4-mhh4-gcgr: Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS Handler

Summary

Details

Steps to Reproduce

GHSA-3jp4-mhh4-gcgr:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

N/A

N/A

GHSA-3jp4-mhh4-gcgr: Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS Handler

Summary

Details

Steps to Reproduce

Impact

Fix

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-3jp4-mhh4-gcgr: Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS Handler

Summary

Details

Steps to Reproduce

GHSA-3jp4-mhh4-gcgr:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

N/A

N/A

GHSA-3jp4-mhh4-gcgr: Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS Handler

Summary

Details

Steps to Reproduce

Impact

Fix

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI