CVE-2026-31982: SAML Open Redirect and Cache Poisoning in Nozomi Networks

Technical summary

CVE-2026-31982 is an open redirect vulnerability (CWE-601) in the SAML Single Sign-On implementation of affected Nozomi Networks products. The flaw stems from insufficient validation of a user-controlled redirection parameter in the SAML sign-in endpoint. An unauthenticated attacker can craft a malicious request to inject an attacker-controlled URL into the cached SAML redirection, poisoning the authentication flow for subsequent users. This cached poisoning mechanism amplifies the attack surface: a single malicious request can affect all users who attempt SAML authentication afterward, without requiring the attacker to target each victim individually.

Business impact

This vulnerability creates two complementary threats to your organization. First, attackers can conduct large-scale phishing campaigns by poisoning the SAML cache, causing users to unknowingly enter credentials into attacker-controlled sites; credential compromise then enables lateral movement, data theft, and system compromise. Second, the same mechanism can be weaponized to cause denial of service by rendering SAML authentication inaccessible to all users, forcing reliance on alternative authentication methods or outright lockout. For organizations that rely on SAML as their primary authentication gateway, this represents a critical availability and confidentiality risk.

Affected systems

Nozomi Networks CMC and Nozomi Networks Guardian are confirmed affected by this vulnerability. Organizations running these products should audit deployed instances for version information and verify exposure against vendor advisories, as patch availability and specific version ranges will be documented in official guidance.

Exploitability

Exploitation is straightforward and does not require authentication or special privileges. An attacker only needs network access to the SAML sign-in endpoint and the ability to craft a malicious request. The attack succeeds when a user initiates the standard SAML single sign-on flow—a normal, expected user action. The cached poisoning mechanism means a single malicious injection can compromise the authentication experience for many users simultaneously, making this vulnerability attractive to attackers seeking broad impact with minimal effort. However, the requirement for user interaction (initiating SAML sign-on) prevents fully unauthenticated, passive exploitation.

Remediation

Apply vendor-supplied security patches as soon as they become available. In the interim, consider restricting network access to SAML endpoints to trusted identity provider IP ranges if your architecture permits, though this is not a complete mitigation. Monitor SAML authentication logs for unusual redirect targets or failed authentication attempts. If available, consult Nozomi Networks' security advisories for interim workarounds or configuration changes that validate redirection parameters more strictly.

Patch guidance

Verify the latest security advisory from Nozomi Networks for Nozomi Networks CMC and Nozomi Networks Guardian to identify patched versions and applicable update procedures. Prioritize patching in your change management process, as this vulnerability affects core authentication infrastructure. Test patches in a non-production environment before deployment to ensure no disruption to SAML-dependent workflows. Given the high severity and broad user impact, expedited patching is justified.

Detection guidance

Monitor SAML authentication endpoints for requests containing unusual or external redirection parameters. Log and alert on SAML responses that redirect to unexpected domains, particularly those not registered to your organization or known identity providers. Examine SAML assertion logs for anomalies such as multiple authentication attempts from a single source IP, failed redirects, or repeated use of suspicious redirect URLs. Correlate SAML authentication failures with HTTP redirect events to identify potential poisoning attempts. Web Application Firewalls (WAFs) should be configured to validate that SAML redirect parameters point only to whitelisted, trusted destinations.

Why prioritize this

A CVSS 7.1 HIGH score reflects the combination of network accessibility, low complexity, lack of authentication requirement, and the broad impact scope across multiple users. While user interaction is required, the cached poisoning mechanism means attackers can affect many users with a single request. For organizations relying on SAML as a primary authentication mechanism, this vulnerability directly threatens both confidentiality (credential theft via phishing) and availability (authentication disruption). The lack of active exploitation in the wild (not on the KEV catalog) provides a narrow window to patch before adversary awareness increases.

Risk score, explained

The 7.1 CVSS score is justified by: (1) network-based attack vector requiring no special access, (2) low attack complexity with no special conditions, (3) no privilege or authentication requirement, (4) user interaction needed but expected as part of normal workflow, (5) scope change affecting other users and the authentication system itself, and (6) confidentiality, integrity, and availability impacts all present. The score appropriately reflects a serious vulnerability that requires urgent attention but falls short of critical due to the user interaction prerequisite.

Frequently asked questions