CVE-2026-123548
Received Received - Intake

Open Redirect Vulnerability in OpenIdentityPlatform OpenAM

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed lists. Attackers can craft OpenAM-domain links that send users to arbitrary external sites for phishing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123548
EUVD
EUVD-2026-119433

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openidentityplatform openam to 16.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenIdentityPlatform OpenAM before version 16.1.4 has an open redirect vulnerability. This means certain pages like WS-Federation logout, SAML v2.0 logout, authentication pages, and others do not validate destination URLs properly. Attackers can create links within OpenAM that redirect users to malicious external sites for phishing attacks.

Impact Analysis

This vulnerability allows attackers to trick users into clicking links that appear legitimate but redirect to fake websites designed to steal credentials or sensitive information. Users may unknowingly expose personal or organizational data to phishing sites.

Mitigation Strategies

Upgrade OpenIdentityPlatform OpenAM to version 16.1.4 or later to address the open redirect vulnerability in WS-Federation logout, SAML v2.0 logout, and authentication pages.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123548. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...