INSA Rouen insa-auth Open Redirect Vulnerability in Secondary Authentication Bridge

A minor open redirect vulnerability has been identified in the INSA Rouen authentication server, specifically in the insa-auth package, prior to May 3, 2025. This issue allowed third-party websites to access the server's secondary authentication bridge, potentially disclosing basic student information such as names and identification numbers. Despite this, the vulnerability posed minimal risk, was never exploited, and had limited impact.

Impact

Exploitation of this vulnerability could have led to unauthorized access to the server's secondary authentication bridge, allowing third-party websites to obtain basic student information, including names and identification numbers.

Remediation

The vulnerability has been patched in versions released on or after May 4, 2025.