Vulnerabilities / OneLogin SAML SSO / WPSEC-2026-2363
OneLogin SAML SSO <= 3.7.0 - Unauthenticated Open Redirect via 'target' and 'redirect_to' Parameters
Medium 6.1
CWE-601Fixed in 3.7.1
- ID
- WPSEC-2026-2363
- Plugin
- OneLogin SAML SSO (onelogin-saml-sso)
- Affected
- from 3.7.0 before 3.7.1
- Remediation
- Update to 3.7.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-601
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03
- Attack surface
- OneLogin SAML SSO on WPSec AttackSurface
- Fix released
- Published
Description
The OneLogin SAML SSO plugin for WordPress is vulnerable to Open Redirect via the 'target' and 'redirect_to' parameters of the SSO endpoint in version 3.7.0 due to insufficient validation of the redirect URL when the user is already logged in. This makes it possible for unauthenticated attackers to redirect logged-in users to potentially malicious sites if they can successfully trick them into clicking a crafted link.
References
- https://wpsec.com/vuln/WPSEC-2026-2363/
- https://plugins.svn.wordpress.org/onelogin-saml-sso/tags/3.7.1/
- https://wordpress.org/plugins/onelogin-saml-sso/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS