CVE-2026-31982

Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0

Published Jul 9, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who subsequently initiate SAML Single Sign-On, enabling phishing and credential-theft attacks, as well as disrupting SAML authentication for all affected users.

Analysis

Technical impact

A user‑controlled redirect parameter in the SAML Single Sign‑On process is insufficiently validated, allowing an attacker to craft a request to the sign‑in endpoint that changes the cached redirect for other users. This open redirect can lure users to phishing sites, steal their credentials, or disrupt legitimate SAML authentication for all affected devices.

Affected Systems

Nozomi Networks CMC and Guardian devices running versions prior to 26.2.0 are affected.

Risk and Exploitability

The vulnerability can be triggered by unauthenticated attackers through the public SAML sign‑in interface, making it an application‑layer attack that does not require privileged credentials. Its CVSS score of 5.3 indicates moderate severity, while an EPSS score of less than 1% suggests a very low probability of exploitation at the time of analysis. The issue is not listed in the CISA KEV catalog. The likely attack vector is via the web interface that processes the SAML sign‑in request.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Nozomi Networks

Guardian

unaffected

Version	Status	Constraints
`0`	affected	< 26.2.0

Nozomi Networks

CMC

unaffected

Version	Status	Constraints
`0`	affected	< 26.2.0

Configuration 1 [-]

OR	cpe:2.3:a:nozominetworks:cmc::::::::
	cpe:2.3:a:nozominetworks:guardian::::::::

No data.

Vendor Product Versions

Nozomi Networks

Cmc

Version	Status	Scheme	Platform
`[0,26.2.0)`	affected	generic	—

Nozomi Networks

Guardian

Version	Status	Scheme	Platform
`[0,26.2.0)`	affected	generic	—

Remediation

Vendor Solution

Upgrade to v26.2.0 or later.

Vendor Workaround

Use internal firewall features to limit access to the web management interface.

OpenCVE Recommended Actions

Upgrade Nozomi Networks CMC or Guardian to v26.2.0 or later
Limit external access to the web management interface with internal firewall or VPN to block unauthenticated SAML requests
Disable or block SAML Single Sign‑On functionality until the patch is applied

Generated by OpenCVE AI on August 1, 2026 at 14:50 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.308% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-827968.html
https://security.nozominetworks.com/NN-2026:9-01

History

Aug 11, 2026 4:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-827968.html

Jul 9, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 9, 2026 8:15 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who subsequently initiate SAML Single Sign-On, enabling phishing and credential-theft attacks, as well as disrupting SAML authentication for all affected users.
Title		Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0
First Time appeared		Nozomi Networks Nozomi Networks cmc Nozomi Networks guardian
Weaknesses		CWE-601
CPEs		cpe:2.3:a:nozomi_networks:cmc:::::::: cpe:2.3:a:nozomi_networks:guardian::::::::
Vendors & Products		Nozomi Networks Nozomi Networks cmc Nozomi Networks guardian
References		https://security.nozominetworks.com/NN-2026:9-01
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:L/SI:L/SA:L'}`