Post-SSO phishing via unvalidated RelayState redirect

Open redirect in Kimai before 2.53.0 allows remote attackers with IdP access to send authenticated users to attacker-controlled sites. The SAML authentication success handler returns the RelayState POST value as a redirect target after checking only that it differs from the configured login path, without validating its host or scheme. SAML must be enabled, and exploitation requires an IdP-initiated flow controlled by an attacker with IdP administrative access or private SAML keys; the redirect supports phishing for credentials or session tokens.