GHSA-3jp4-mhh4-gcgr: Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS Handler

The SAML authentication success handler in Kimai returns the RelayState POST parameter as a redirect destination without validating the host or scheme. After a user successfully authenticates via SAML, they are redirected to an attacker-controlled URL if the IdP includes a malicious RelayState value. This enables phishing attacks that steal credentials or session tokens post-SSO.

Requires SAML to be enabled (non-default configuration).