Open Redirect Vulnerability in OpenAM

Executive Summary

CVE-2026-105118 is an open redirect vulnerability in OpenAM versions before 16.1.3. It occurs in the /oauth2/connect/endSession endpoint which accepts an unverified id_token_hint parameter. Attackers can supply a forged hint to redirect users to any registered post-logout URI, enabling phishing attacks that exploit the OpenAM host's trusted domain.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for requests to the /oauth2/connect/endSession endpoint with an id_token_hint parameter. Check if the endpoint accepts unverified hints and redirects users to arbitrary URIs. Review OpenAM logs for suspicious post-logout redirect attempts or unauthorized realm client manipulations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to redirect users to malicious websites by manipulating the post-logout redirect URI. Victims may be tricked into entering credentials or sensitive information on fake pages that appear to be part of the legitimate OpenAM host, leading to potential account compromise or data theft.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling phishing attacks that exploit OpenAM's trusted domain. Unauthorized redirects may lead to unauthorized access to personal data, violating GDPR's data protection principles or HIPAA's safeguards for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenAM to version 16.1.3 or later to patch the vulnerability. As temporary measures, disable dynamic client registration, review and restrict post-logout URIs, and limit access to the registration endpoint. Monitor for any ongoing exploitation attempts.

Useful 0 Not Useful 0