# CVE-2025-61782: OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version…

Source: https://junglewise.ai/threats/cve-2025-61782-pysec-2026-2264-opencti-is-an-open-source-platform-for-managing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-07  
License: CC BY 4.0 with a link back

CVE-2025-61782 · Severity: medium · CVSS 5.4 · Published 2026-01-07

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callback). By manipulating the RelayState parameter, an attacker can force the server to issue a 302 redirect to any external URL, enabling phishing, credential theft, and arbitrary site redirection. This issue has been patched in version 6.8.3.

Technologies: [Citeum Opencti](https://junglewise.ai/threats/technologies/opencti), [pycti (PyPI)](https://junglewise.ai/threats/technologies/pycti). Vendors: [Citeum](https://junglewise.ai/threats/vendors/citeum), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-61782 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-61782 being exploited in the wild.

**How severe is CVE-2025-61782?** Medium severity, with a CVSS score of 5.4, published 7 January 2026.

**Which products and versions are affected?** pycti (PyPI) ECOSYSTEM:introduced=0,fixed=6.8.3.

**Is there a fix for CVE-2025-61782?** Yes. pycti (PyPI): upgrade to 6.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-61782?** Check whether you run Citeum Opencti or pycti (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pycti (PyPI): upgrade to 6.8.3 or later

  ```sh
  pip install "pycti>=6.8.3"
  ```


## Affected products

- Citeum Opencti
- pycti (PyPI) ECOSYSTEM:introduced=0,fixed=6.8.3

## Identifiers

- CVE-2025-61782
- PYSEC-2026-2264

## Related threats

- [Filigran OpenCTI Code Injection in GraphQL API](https://junglewise.ai/threats/cve-2026-35211-filigran-opencti-code-injection-in-graphql-api)
- [Filigran OpenCTI authorization bypass via synchronized-upsert header](https://junglewise.ai/threats/cve-2026-35210-filigran-opencti-authorization-bypass-via-synchronized-upsert)
- [OpenCTI SSRF in Data Ingestion Feature](https://junglewise.ai/threats/cve-2026-21887-opencti-ssrf-in-data-ingestion-feature)
- [OpenCTI GraphQL introspection restriction bypass](https://junglewise.ai/threats/cve-2024-37155-opencti-graphql-introspection-restriction-bypass)
- [OpenCTI XSS in email-message observable body rendering](https://junglewise.ai/threats/cve-2026-35212-opencti-xss-in-email-message-observable-body-rendering)