CVE-2026-123546
Received Received - Intake

Open Redirect and XSS in OpenAM Before 16.1.4

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run script in the XUI to steal session cookies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123546
EUVD
EUVD-2026-119431

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
forgerock openam to 16.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects OpenAM versions before 16.1.4. It involves an open redirect and cross-site scripting (XSS) flaw due to improper handling of the 'goto' and 'gotoOnFail' parameters. Attackers can manipulate these parameters to redirect users to malicious sites or execute scripts in the OpenAM user interface (XUI) to steal session cookies.

Detection Guidance

To detect this vulnerability, monitor OpenAM login/logout URLs for suspicious 'goto' or 'gotoOnFail' parameters. Check if these parameters redirect to external domains or contain script tags. Review server logs for unusual redirection patterns or XSS attempts in the XUI interface.

Impact Analysis

Attackers could exploit this to redirect you to phishing sites after login or logout, steal your session cookies via XSS, or perform actions on your behalf. This could lead to unauthorized access to your account or sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Upgrade OpenAM to version 16.1.4 or later. Configure valid goto URL resources to restrict redirection targets. Set session cookies as HttpOnly. Filter 'goto' and 'gotoOnFail' parameters at the reverse proxy level. Raise user awareness about phishing risks from manipulated links.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123546. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...