CVE-2026-123547 PUBLISHED

OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState

Assigner: VulnCheck
Reserved: 06.11.2026 Published: 08.11.2026 Updated: 08.11.2026

OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrlList is configured. Attackers can craft single sign-on links with a malicious RelayState to send users from the trusted OpenAM origin to phishing sites and bypass URL filters.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS Score: 2.3

Product Status

Vendor OpenIdentityPlatform
Product OpenAM
Versions Default: unaffected
  • affected from 0 to 16.1.4 (excl.)
  • Version 16.1.4 is unaffected
Vendor OpenIdentityPlatform
Product OpenAM
Versions Default: unaffected
  • affected from 0 to 16.1.4 (excl.)
  • Version 16.1.4 is unaffected

Credits

  • santhreal reporter
  • vharseko remediation developer
  • maximthomas remediation reviewer
  • tsujiguchitky remediation reviewer

References

Problem Types

  • URL Redirection to Untrusted Site ('Open Redirect') CWE