CVE-2026-31982 Overview
CVE-2026-31982 is an Open Redirect vulnerability [CWE-601] affecting the SAML Single Sign-On (SSO) functionality of a Nozomi Networks product. The flaw stems from insufficient validation of a user-controlled redirection parameter on the SAML sign-in endpoint. An unauthenticated attacker can craft a request that poisons the cached SAML redirection value for other users. Subsequent SAML SSO attempts by legitimate users are redirected to attacker-controlled destinations. This enables phishing and credential-theft campaigns and disrupts SAML authentication for all affected users.
Critical Impact
Unauthenticated attackers can poison the cached SAML redirect used by legitimate users, redirecting SSO flows to attacker-controlled sites and breaking SAML authentication for the tenant.
Affected Products
- Nozomi Networks product with SAML Single Sign-On functionality (see vendor advisory NN-2026:9-01)
Discovery Timeline
- 2026-07-09 - CVE CVE-2026-31982 published to NVD
- 2026-07-09 - Last updated in NVD database
Technical Details for CVE-2026-31982
Vulnerability Analysis
The vulnerability is an Open Redirect [CWE-601] within the SAML SSO sign-in endpoint. The endpoint accepts a redirection parameter supplied by the client and does not validate that the destination belongs to an approved allow-list of relay URLs. Because the affected implementation caches this redirection value server-side and reuses it for other users who initiate SAML SSO, an attacker can perform a stored-style redirect poisoning attack. A single crafted unauthenticated request influences the SSO flow of every subsequent user. The impact is dual: users are redirected to phishing infrastructure that can capture credentials, and legitimate SAML authentication is disrupted for the tenant until the cache is cleared or the service is restarted. The attack requires user interaction, as victims must initiate SSO after the cache is poisoned.
Root Cause
The SAML sign-in endpoint trusts a user-supplied redirection parameter without validating it against an allow-list of trusted domains or relative paths. The parameter value is then persisted in a shared redirection cache used by other user sessions, converting a per-request open redirect into a cross-user redirection primitive.
Attack Vector
The attack is remote, unauthenticated, and network-based. An attacker issues a crafted HTTP request to the SAML sign-in endpoint containing a malicious redirection parameter pointing to an attacker-controlled host. The application stores this value in its SAML redirection cache. When a legitimate user initiates SAML SSO, the application returns the poisoned redirect and sends the victim to the attacker-controlled destination, where credential harvesting or malware delivery can occur.
No verified exploit code has been published. See the Nozomi Networks Security Advisory NN-2026:9-01 for vendor technical details.
Detection Methods for CVE-2026-31982
Indicators of Compromise
- Outbound HTTP redirects from the SAML sign-in endpoint pointing to hosts outside the organization's federation domains
- User reports of SAML SSO landing on unfamiliar login pages or unexpected external URLs
- Unauthenticated POST or GET requests to the SAML sign-in endpoint with unusual RelayState, ReturnUrl, or redirection query parameters
- Spike in failed or interrupted SAML authentication attempts across multiple users
Detection Strategies
- Inspect reverse proxy and web server logs for requests to the SAML sign-in endpoint containing off-domain URLs in redirection parameters
- Alert when HTTP 302 responses from the SSO endpoint contain Location headers that do not match the approved identity provider or service provider domains
- Correlate unauthenticated access to the SAML endpoint with subsequent redirect responses served to authenticated user sessions
Monitoring Recommendations
- Continuously monitor SAML SSO redirect destinations and baseline them against a fixed allow-list
- Ingest web application and identity provider logs into a SIEM to detect anomalous redirection patterns
- Track cache-related SAML redirection state and alert on modifications from unauthenticated sources
How to Mitigate CVE-2026-31982
Immediate Actions Required
- Apply the fixed version described in the Nozomi Networks Security Advisory NN-2026:9-01
- Restart affected services after patching to clear any poisoned SAML redirection cache entries
- Communicate to users that SAML SSO links should be initiated only from trusted internal portals until patching is complete
Patch Information
Refer to the Nozomi Networks Security Advisory NN-2026:9-01 for the specific fixed release and upgrade guidance. Nozomi Networks addressed the issue by enforcing validation of the redirection parameter against an allow-list of trusted destinations.
Workarounds
- Restrict network access to the SAML sign-in endpoint to trusted management networks where operationally feasible
- Configure the reverse proxy or Web Application Firewall (WAF) to block or normalize requests containing absolute URLs in SAML redirection parameters
- Instruct users to authenticate through the identity provider portal directly rather than via service-provider-initiated SSO links until the patch is applied
# Example WAF rule concept: reject SAML sign-in requests whose redirection
# parameter contains an absolute URL to an untrusted host.
# Adapt regex and parameter name to match the affected product.
SecRule REQUEST_URI "@beginsWith /saml/signin" \
"chain,deny,status:400,id:1029831,msg:'CVE-2026-31982 open redirect attempt'"
SecRule ARGS:RelayState|ARGS:ReturnUrl "@rx ^https?://(?!sso\.example\.com/)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
