CVE-2026-105118: OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession

Q: Who can exploit this issue, and what interaction is required?

An unauthenticated attacker can craft a request to the /oauth2/connect/endSession endpoint with a forged id_token_hint. Exploitation requires a victim to follow the resulting redirect, making the primary risk phishing that appears to originate from the trusted OpenAM host.

Q: What destinations can an attacker use for the redirect?

The attacker can select any registered post-logout URI by naming a realm client in the forged hint. The issue does not indicate that arbitrary unregistered destinations are accepted.

Q: Which deployments are affected?

ForgeRock OpenAM versions before 16.1.3 are affected. The provided information does not identify configuration prerequisites or exceptions.

Published Oct 3, 2026

Updated

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified idtokenhint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered post-logout URI, enabling phishing that borrows the OpenAM host's trust.

Affected Software

1 affected component

ForgeRock OpenAM<16.1.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenAM to a version that resolves this vulnerability.
Fixed in 16.1.3

Event History

Oct 3, 2026

CVE Published

via MITRE·12:14 PM

Data Sourced

via MITRE·12:14 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and what interaction is required?

An unauthenticated attacker can craft a request to the /oauth2/connect/endSession endpoint with a forged id_token_hint. Exploitation requires a victim to follow the resulting redirect, making the primary risk phishing that appears to originate from the trusted OpenAM host.

What destinations can an attacker use for the redirect?

The attacker can select any registered post-logout URI by naming a realm client in the forged hint. The issue does not indicate that arbitrary unregistered destinations are accepted.

Which deployments are affected?

ForgeRock OpenAM versions before 16.1.3 are affected. The provided information does not identify configuration prerequisites or exceptions.

CVE-2026-105118: OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue, and what interaction is required?

What destinations can an attacker use for the redirect?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and what interaction is required?

What destinations can an attacker use for the redirect?

Which deployments are affected?