Description
Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL instead of to CloudVision.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Arista Networks CloudVision Portal
Default version status: unaffected
2026.2.0affected2026.1.0 to ≤ 2026.1.2affected2025.3.0 to ≤ 2025.3.3affected2021.1.0 to < 2025.3.0affected