CVE-2025-12789: Red Hat SSO Open Redirect Vulnerability

CVE-2025-12789 Overview

CVE-2025-12789 is an Open Redirect vulnerability [CWE-601] affecting Red Hat Single Sign-On (RH-SSO). The flaw resides in the OpenID Connect logout endpoint, where the redirect_uri parameter does not undergo proper URL validation. Attackers can craft logout links that redirect authenticated users to attacker-controlled domains after session termination. This behavior facilitates phishing campaigns and credential harvesting by abusing the trusted RH-SSO domain in the initial request. The issue carries a CVSS 3.1 score of 6.1 and requires user interaction to succeed.

Critical Impact
Attackers can leverage the trusted RH-SSO logout endpoint to redirect users to malicious sites, enabling phishing attacks that appear to originate from a legitimate identity provider.

Affected Products

Red Hat Single Sign-On (RH-SSO)
Deployments using the OpenID Connect logout protocol with redirect_uri handling
Downstream applications relying on RH-SSO as their identity provider

Discovery Timeline

2025-11-07 - CVE-2025-12789 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12789

Vulnerability Analysis

The vulnerability exists in the RP-Initiated Logout flow defined by the OpenID Connect specification. When a relying party sends a user to the RH-SSO logout endpoint, it supplies a redirect_uri (or post_logout_redirect_uri) parameter that instructs the identity provider where to send the user after the session ends. RH-SSO does not correctly validate this parameter against the client's registered post-logout redirect URIs. As a result, arbitrary external URLs are honored.

The attack requires user interaction, since the victim must click a crafted logout link. The scope is changed because a flaw in the identity provider affects downstream relying parties. Both confidentiality and integrity impacts are limited, reflecting the phishing and session-manipulation risk rather than direct data compromise.

Root Cause

The root cause is insufficient allowlist enforcement on the redirect_uri value processed by the OpenID Connect logout handler. The handler accepts the parameter without matching it against the client's configured post-logout URIs, violating the OpenID Connect specification's requirement to validate redirection targets [CWE-601].

Attack Vector

An attacker constructs a logout URL pointing at the legitimate RH-SSO server but sets redirect_uri to an attacker-controlled domain. The attacker distributes the link through email, chat, or a compromised web page. When the victim clicks it, RH-SSO terminates the session and issues an HTTP redirect to the attacker's site. The destination page can mimic the RH-SSO login screen to harvest credentials or deliver malicious content under the perceived trust of the identity provider.

See the Red Hat CVE Advisory and Red Hat Bug Report #2413001 for vendor-published technical detail.

Detection Methods for CVE-2025-12789

Indicators of Compromise

Logout requests to RH-SSO endpoints containing redirect_uri or post_logout_redirect_uri values pointing to external or unregistered domains.
HTTP 302 responses from RH-SSO with Location headers referencing hosts outside the organization's approved allowlist.
Spikes in outbound referrer traffic from the RH-SSO hostname to newly registered or low-reputation domains.

Detection Strategies

Parse RH-SSO access logs for logout requests and compare the redirect_uri parameter against the configured post-logout URIs for each client.
Alert on any logout redirect target whose registrable domain does not match a corporate-owned or explicitly approved domain.
Correlate user click-through events with subsequent authentication attempts from unusual geolocations to catch credential-harvesting follow-on activity.

Monitoring Recommendations

Ingest RH-SSO event logs into a centralized logging or SIEM platform and retain them for post-incident analysis.
Enable RH-SSO's built-in event listener for LOGOUT and LOGOUT_ERROR events and forward them to security operations.
Monitor egress web proxy logs for referrals originating from the RH-SSO hostname to catch off-allowlist redirects in real time.

How to Mitigate CVE-2025-12789

Immediate Actions Required

Apply the fixed RH-SSO packages published in the Red Hat CVE Advisory as soon as they are available for your subscription channel.
Audit each client configured in RH-SSO and populate the Valid Post Logout Redirect URIs field with an explicit allowlist. Remove wildcard entries.
Educate users to inspect logout links before clicking, particularly those received through email or messaging platforms.

Patch Information

Refer to the Red Hat CVE Advisory for the authoritative list of fixed builds and errata identifiers. Track remediation progress through Red Hat Bug Report #2413001. Apply the vendor updates through dnf or yum on affected hosts and restart the RH-SSO service after installation.

Workarounds

Restrict outbound HTTP redirects from the RH-SSO logout endpoint at the reverse proxy layer, blocking Location headers that reference external domains.
Set the Valid Post Logout Redirect URIs for every client to specific, fully qualified URLs and avoid the + shortcut that inherits from Valid Redirect URIs when wildcards are present.
Deploy a web application firewall rule that rejects logout requests whose redirect_uri parameter does not resolve to an approved host.

bash

# Example: enforce a strict post-logout redirect allowlist via kcadm
kcadm.sh update clients/<client-uuid> -r <realm> \
  -s 'attributes."post.logout.redirect.uris"="https://app.example.com/logout+https://portal.example.com/signout"'