CVE-2026-105116: OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page
OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce auto-submit page. If reachable with cookieHashRedirectEnabled set, crafted requests could execute script in the OpenAM origin, though an unrelated HTTP 500 failure prevents exploitation in released versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenAMto a version that resolves this vulnerability.Fixed in 16.1.3
Event History
Frequently Asked Questions
Which deployments are exposed to the vulnerable code path?
The affected path is reachable only when cookieHashRedirectEnabled is enabled and the SAML load-balancer cookie bounce page can be reached. The issue applies to OpenAM versions before 16.1.3.
What does an attacker need to do to trigger the XSS condition?
An attacker would need to send a crafted request that supplies malicious content in the SAML message, relay state, or target URL fields. These values are placed into the auto-submit page without encoding, potentially allowing script execution in the OpenAM origin.
Is this exploitable in released versions?
The advisory states that an unrelated HTTP 500 failure prevents exploitation in released versions. The flaw is therefore described as latent despite the unencoded output.
What can be done if upgrading is not immediately possible?
Disable cookieHashRedirectEnabled where operationally feasible, or otherwise ensure the SAML load-balancer cookie bounce path is not reachable. This removes the stated condition required to reach the vulnerable page.