Summary by 2yuk
While testing the application's SAML authentication flow, I discovered that the RelayState parameter was not properly validated. By supplying an attacker-controlled value, it was possible to influence the URL users were redirected to after a successful login.
Although the issue did not compromise authentication itself, it could have been abused to redirect users to a malicious website immediately after authentication, increasing the effectiveness of phishing and other social engineering attacks.