# OneLogin SAML SSO <= 3.7.0 - Unauthenticated Open Redirect via 'target' and 'redirect_to' Parameters

- **ID:** WPSEC-2026-2363
- **Plugin:** OneLogin SAML SSO (`onelogin-saml-sso`), https://wordpress.org/plugins/onelogin-saml-sso/
- **Affected versions:** from 3.7.0 before 3.7.1
- **Fixed in:** 3.7.1 (Update to 3.7.1 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-601
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/onelogin-saml-sso
- **Fix released:** 2026-10-31
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2363/

## Description

The OneLogin SAML SSO plugin for WordPress is vulnerable to Open Redirect via the 'target' and 'redirect_to' parameters of the SSO endpoint in version 3.7.0 due to insufficient validation of the redirect URL when the user is already logged in. This makes it possible for unauthenticated attackers to redirect logged-in users to potentially malicious sites if they can successfully trick them into clicking a crafted link.

## References

- https://wpsec.com/vuln/WPSEC-2026-2363/
- https://plugins.svn.wordpress.org/onelogin-saml-sso/tags/3.7.1/
- https://wordpress.org/plugins/onelogin-saml-sso/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2363/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.