CVE-2025-6701: Open Redirect Vulnerability in com.xuxueli:xxl-sso
Summary
CVE-2025-6701: XXL SSO is vulnerable to an Open Redirect through malicious manipulation of the redirect_url argument. Affects com.xuxueli:xxl-sso versions < 1.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XXL SSO is an open-source single sign-on solution that provides authentication services for web applications. It simplifies user management and enhances security by allowing users to log in once and gain access to multiple applications without needing to log in again. However, version 1.1.0 of XXL SSO contains a vulnerability that can be exploited through improper handling of the redirect_url parameter.
Vulnerability Detail
A vulnerability classified as problematic has been identified in the XXL SSO package version 1.1.0. This issue arises from the manipulation of the redirect_url argument within the /xxl-sso-server/doLogin file, leading to an open redirect. This flaw allows attackers to redirect users to malicious sites, potentially compromising user data and security. The vulnerability can be exploited remotely, and it has been publicly disclosed, making it critical for users to address it promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement server-side validation to ensure that the redirect_url parameter only points to trusted domains. This can be done by checking the URL against a whitelist of allowed domains before processing the login request.
Conclusion
The open redirect vulnerability in XXL SSO version 1.1.0 poses a risk to users by allowing potential redirection to malicious sites. It is crucial for users to update to a patched version to mitigate this risk. Implementing server-side validation can serve as a temporary workaround while the update is applied.
See every vulnerability recorded for com.xuxueli:xxl-sso →
FAQ
An open redirect vulnerability allows attackers to redirect users to arbitrary URLs, potentially leading to phishing attacks or other malicious activities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Exploiting this vulnerability can lead to users being redirected to malicious sites, which may result in data theft, phishing attacks, or malware installation.
Yes, updating to a version beyond 1.1.0 of the XXL SSO package will address this vulnerability.
The CVSS score for this vulnerability is 3.5, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.xuxueli:xxl-sso.
