What’s Vulnerable › Vulnerabilities

CVE-2025-46826: insa-auth Open-Redirect on provided CAS server login endpoint

• Severity: low (CVSS 1.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-07 · updated 2026-06-17
• Weakness: CWE-601

Description

insa-auth is an authentication server for INSA Rouen. A minor issue allowed third-party websites to access the server's secondary authentication bridge, potentially revealing basic student information (name and number). However, the issue posed minimal risk, was never exploited, and had limited impact. A fix was implemented promptly on May 3, 2025.

Affected products

• INSAgenda insa-auth: before 2025-05-03

References

• https://github.com/INSAgenda/insa-auth/commit/8c1e68b2fb55aa952f522ead55a6587526982a2c
• https://github.com/INSAgenda/insa-auth/commit/b0e7508e6ca4360e39fb1fd931f8d47b1f992ced
• https://github.com/INSAgenda/insa-auth/commit/c77cf2e25778f83ebf5c4fdb4ded3ffcc8cfd74d
• https://github.com/INSAgenda/insa-auth/security/advisories/GHSA-63xr-gvjv-r6xv

Get alerted when CVE-2025-46826 or the next vulnerability affects your stack