CVE-2026-121825
Received Received - Intake

Open Redirect in OpenAM Liberty ID-FF Service Provider

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: openam-jp

Description
OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier contains an open redirect vulnerability (CWE-601) in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without validation, and after the user completes single sign-on at the identity provider, the assertion consumer service redirects the browser to that value. A remote unauthenticated attacker can induce a user to access a crafted URL and, after the user authenticates, redirect the user to an arbitrary website, which may be used for phishing. Only deployments in which a Liberty ID-FF hosted service provider is configured are affected; Liberty ID-FF is not configured by default. This issue is fixed in 14.0.6, which disables the legacy Liberty ID-FF endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-121825
EUVD
EUVD-2026-119785

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OpenAM consortium OpenAM (OpenAM Consortium Edition) From 14.0.0 (inc) to 14.0.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-121825 is an open redirect vulnerability in OpenAM versions 14.0.5 and earlier. It occurs in the Liberty ID-FF service provider single sign-on flow due to the /preLogin endpoint's goto parameter not being validated. Attackers can craft URLs that redirect users to arbitrary websites after authentication, enabling phishing attacks.

Detection Guidance

Check OpenAM version for affected releases (14.0.5 or earlier). Inspect network traffic for requests to /preLogin endpoint with goto parameter. Monitor logs for unexpected redirects after authentication. Use WAF or reverse proxy rules to block legacy Liberty ID-FF endpoints.

Impact Analysis

This vulnerability allows remote unauthenticated attackers to redirect users to malicious websites after they authenticate. This could lead to phishing attacks where users unknowingly enter credentials or sensitive information on attacker-controlled sites.

Mitigation Strategies

Upgrade OpenAM to version 14.0.6 or later. Disable legacy Liberty ID-FF endpoints by removing servlet mappings from WEB-INF/web.xml. Block access to /preLogin endpoint via WAF or reverse proxy. Rotate all active session tokens after applying fixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121825. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...