The following scripts were not checking the URLs obtained via the HTTP request before displaying them as the target of links that the user may click on: - "www/logout.php" - "modules/core/www/no_cookie.php" The issue allowed attackers to display links targeting a malicious website inside a trusted site running SimpleSAMLphp, due to the lack of security checks involving the "link_href" and "retryURL" HTTP parameters, respectively. The issue was resolved by including a verification of the URLs received in the request against a white list of websites specified in the "trusted.url.domains" configuration option.