CVE-2025-61782
Medium
Description
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callback). By manipulating the RelayState parameter, an attacker can force the server to issue a 302 redirect to any external URL, enabling phishing, credential theft, and arbitrary site redirection. This issue has been patched in version 6.8.3.
SeverityMedium
CVSS5.4
Exploit probability—
ProductCiteum Opencti
PublishedJan 7, 2026
First seenJan 7, 2026
Weakness typeCWE-601Open redirect
How to fix
Update
- citeum opencti6.8.3 or later
- pycti6.8.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| citeum opencti | v < 6.8.3 | 6.8.3 |
| pyctiPyPI | v < 6.8.3 | 6.8.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.