CVE-2025-50055 — OpenVPN / Access Server

CVE-2025-50055

OpenVPN / Access Server PUBLISHED

Description (CNA)

Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML Assertion Consumer Service (ACS) endpoint servers to inject arbitrary web script or HTML via the RelayState parameter

Affected (CNA)

Vendor / product	Versions
OpenVPN / Access Server	affected 2.14.0 through 2.14.3

CWE

CWE-79

References

https://openvpn.net/as-docs/as-3-0-release-notes.html#access-server-3-0-0

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.