This vulnerability (CWE-601) in Nozomi Networks Guardian affects the SAML Single Sign-On process by allowing an attacker to manipulate the redirection parameter without proper validation. This can lead to an open redirect scenario where subsequent users are redirected to attacker-controlled sites. The flaw enables phishing and credential theft attacks and can disrupt authentication for all users relying on the affected SAML SSO endpoint. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity). No patch or official remediation guidance is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

An unauthenticated attacker can exploit this vulnerability to poison the cached SAML redirection URL, causing other users to be redirected to untrusted sites during SAML Single Sign-On. This can facilitate phishing attacks, credential theft, and denial of service against the SAML authentication process for all affected users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, users should monitor Nozomi Networks advisories for updates. Until a fix is available, consider restricting access to the SAML sign-in endpoint or implementing additional validation on redirection parameters if possible.