CVE-2025-61782: Citeum OpenCTI Auth Bypass Vulnerability

CVE-2025-61782 Overview

CVE-2025-61782 is an open redirect vulnerability in OpenCTI, an open source platform for managing cyber threat intelligence knowledge and observables. The flaw exists in the SAML authentication callback endpoint (/auth/saml/callback) in versions prior to 6.8.3. Attackers can manipulate the RelayState parameter to force the server to issue a 302 redirect to an arbitrary external URL. This enables phishing campaigns, credential theft, and abuse of the platform's trusted domain for arbitrary site redirection. The vendor released a fix in OpenCTI 6.8.3 that improves RelayState and referer verification. The issue is tracked under CWE-601: URL Redirection to Untrusted Site.

Critical Impact
An unauthenticated attacker can craft URLs against a trusted OpenCTI instance that redirect victims to attacker-controlled sites, facilitating credential harvesting against threat intelligence analysts.

Affected Products

OpenCTI (citeum:opencti) versions prior to 6.8.3
Deployments exposing the /auth/saml/callback endpoint
Any SAML-integrated OpenCTI instances relying on default RelayState handling

Discovery Timeline

2026-01-07 - CVE-2025-61782 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61782

Vulnerability Analysis

OpenCTI supports SAML-based single sign-on through the /auth/saml/callback endpoint. During SAML flows, identity providers echo back a RelayState parameter that the service provider uses to determine where the user should land after authentication. In OpenCTI versions before 6.8.3, the platform trusted the RelayState value without validating it against an allowlist or the configured base URL. The endpoint issues an HTTP 302 response with the attacker-supplied value in the Location header. Threat actors can distribute links pointing to a legitimate OpenCTI domain that silently forward victims to phishing pages mimicking the OpenCTI login screen or other trusted services.

Root Cause

The root cause is missing destination validation in the HTTP platform routing logic. The upstream fix in commit f755165a introduces a getBaseUrl helper imported from ../config/conf inside opencti-platform/opencti-graphql/src/http/httpPlatform.js. The patch uses this helper to constrain RelayState and referer values to the platform's configured base URL, preventing off-origin redirects.

Attack Vector

Exploitation requires user interaction: the victim must click an attacker-crafted URL pointing to the trusted OpenCTI host. The attacker appends a manipulated RelayState value referencing an external domain. When the SAML callback completes, the server returns a 302 redirect to the attacker's URL. Because the initial hostname belongs to the organization's threat intelligence platform, victims are more likely to trust the resulting phishing page. The attack is scoped as changing security boundaries because the redirect leverages the trust of the SAML-enabled origin.

javascript

// Patch excerpt: opencti-platform/opencti-graphql/src/http/httpPlatform.js
 import rateLimit from 'express-rate-limit';
 import contentDisposition from 'content-disposition';
 import { printSchema } from 'graphql/utilities';
-import { basePath, DEV_MODE, ENABLED_UI, logApp, OPENCTI_SESSION, PLATFORM_VERSION, AUTH_PAYLOAD_BODY_SIZE } from '../config/conf';
+import { basePath, DEV_MODE, ENABLED_UI, logApp, OPENCTI_SESSION, PLATFORM_VERSION, AUTH_PAYLOAD_BODY_SIZE, getBaseUrl } from '../config/conf';
 import passport, { isStrategyActivated, STRATEGY_CERT } from '../config/providers';
 import { HEADERS_AUTHENTICATORS, loginFromProvider, sessionAuthenticateUser, userWithOrigin } from '../domain/user';
 import the downloadFile, getFileContent, isStorageAlive, loadFile } from '../database/file-storage';

Source: OpenCTI commit f755165a - the patch adds getBaseUrl to enforce redirect destinations against the platform's configured base URL.

Detection Methods for CVE-2025-61782

Indicators of Compromise

HTTP 302 responses from /auth/saml/callback where the Location header points to a domain outside the configured OpenCTI base URL.
Requests to /auth/saml/callback containing RelayState parameters with absolute URLs or encoded external hostnames.
Referer values on SAML callbacks that do not match the platform's own origin.
Phishing emails or messages referencing the organization's OpenCTI hostname with unusually long query strings.

Detection Strategies

Parse web server and reverse proxy logs for /auth/saml/callback requests and alert when RelayState decodes to a domain not on an approved allowlist.
Deploy a Web Application Firewall (WAF) rule that inspects RelayState values and blocks fully qualified URLs pointing off-origin.
Correlate outbound redirect events with downstream DNS or proxy telemetry to detect users landing on newly registered or low-reputation domains.

Monitoring Recommendations

Track the OpenCTI version banner and confirm all instances report version 6.8.3 or later.
Monitor identity provider logs for successful SAML assertions immediately followed by user reports of credential prompts on unfamiliar domains.
Alert on spikes of 302 responses from authentication endpoints, which may indicate scripted redirect abuse.

How to Mitigate CVE-2025-61782

Immediate Actions Required

Upgrade all OpenCTI deployments to version 6.8.3 or later, which contains the RelayState and referer verification fix.
Audit recent access logs on /auth/saml/callback for suspicious RelayState values and notify any users who may have followed redirected links.
Communicate to analysts that legitimate OpenCTI SAML flows should never redirect to external domains after authentication.

Patch Information

The fix is included in OpenCTI release 6.8.3 and detailed in GitHub Security Advisory GHSA-jc3f-c62g-v7qw. The remediation commit f755165a26888925c4a58018f7238ff92a0bd378 introduces the getBaseUrl helper in httpPlatform.js to constrain redirect destinations to the configured platform base URL.

Workarounds

Place a reverse proxy in front of OpenCTI that strips or validates RelayState parameters against the platform's own hostname before forwarding to the callback endpoint.
Restrict access to /auth/saml/callback at the network layer so only expected identity provider egress IPs can initiate SAML callbacks.
Train users to verify the final destination URL after SSO redirects and to report unexpected external prompts.

bash

# Example NGINX snippet: block external RelayState values before they reach OpenCTI
location /auth/saml/callback {
    if ($arg_RelayState ~* "^https?://(?!opencti\.example\.com)") {
        return 400;
    }
    proxy_pass http://opencti_backend;
}