SAML Single Sign-On Open Redirect Cache Poisoning

An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who subsequently initiate SAML Single Sign-On, enabling phishing and credential-theft attacks, as well as disrupting SAML authentication for all affected users.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-31982 is a critical authentication bypass vulnerability affecting SAML SSO implementations through open redirect exploitation combined with cache poisoning. The flaw stems from insufficient validation of user-controlled redirection parameters in the SAML sign-in endpoint, allowing unauthenticated attackers to manipulate redirect targets and corrupt cached authentication flows. Organizations relying on SAML for federated identity management are at risk, including enterprise users, SaaS platforms, and any system using vulnerable SSO providers. The impact extends beyond individual credential theft to systemic disruption—attackers can poison the authentication cache to affect all downstream users attempting SAML authentication, creating widespread service degradation alongside targeted phishing opportunities.

Casky's platform identifies this attack pattern through its 322 matched security skills using Claude AI's extended reasoning capabilities. Practitioners will see detections aligned with MITRE ATT&CK TA0001 (Initial Access) through phishing and credential harvesting vectors, and TA0043 (Reconnaissance) as attackers probe SAML endpoints for validation gaps. The skills flag suspicious redirect parameter manipulation, cache anomalies indicating poisoned authentication states, and patterns of unauthenticated access to SSO endpoints. Security teams using Casky will observe findings highlighting: unexpected redirection domains in SAML responses, repeated authentication failures from legitimate users (indicating cache corruption), and HTTP referer chains showing attacker-controlled intermediate redirects—all indicators of active exploitation of CVE-2026-31982.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-31982.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-31982

Casky has 322 skills that investigate the attack patterns behind CVE-2026-31982. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn