CVE-2026-123548 PUBLISHED

OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages

Assigner: VulnCheck
Reserved: 06.11.2026 Published: 08.11.2026 Updated: 08.11.2026

OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed lists. Attackers can craft OpenAM-domain links that send users to arbitrary external sites for phishing.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS Score: 2.3

Product Status

Vendor OpenIdentityPlatform
Product OpenAM
Versions Default: unaffected
  • affected from 0 to 16.1.4 (excl.)
  • Version 16.1.4 is unaffected
Vendor OpenIdentityPlatform
Product OpenAM
Versions Default: unaffected
  • affected from 0 to 16.1.4 (excl.)
  • Version 16.1.4 is unaffected

Credits

  • santhreal reporter
  • vharseko remediation developer
  • maximthomas remediation reviewer
  • tsujiguchitky remediation reviewer

References

Problem Types

  • URL Redirection to Untrusted Site ('Open Redirect') CWE