CVE-2026-31982 Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0
An unauthenticated attacker can exploit an open redirect in SAML SSO to poison redirection caches, enabling phishing and credential theft against users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-31982?
CVE-2026-31982 is a medium-severity vulnerability in Nozomi Networks CMC, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who subsequently initiate SAML Single Sign-On, enabling phishing and credential-theft attacks, as well as disrupting SAML authentication for all affected users.
Weakness: CWE-601
Which versions are affected by CVE-2026-31982?
It affects 2 products.
Products include Nozominetworks Cmc, Nozominetworks Guardian.
How do I fix CVE-2026-31982?
No fix has been published for CVE-2026-31982 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-31982 being exploited?
There is no known exploitation of CVE-2026-31982 in the wild and no public exploit code.
Other vulnerabilities in Nozomi Networks CMC
- CVE-2023-29245 SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0
- CVE-2026-31984 DoS through oversized audit log entries in Guardian/CMC before 26.2.0
- CVE-2023-2567 Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0
- CVE-2023-22378 Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2
- CVE-2023-23574 Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2
Sources
Also known as GHSA-mhgm-6mc5-8v9j.