CVE-2026-123548: Security vulnerability

Published Nov 8, 2026

Updated

OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed lists. Attackers can craft OpenAM-domain links that send users to arbitrary external sites for phishing.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which OpenAM deployments are exposed?

OpenAM versions before 16.1.4 are affected where users can reach the vulnerable WS-Federation logout, SAML v2.0 logout, name-identifier management, identity provider finder, or affected authentication pages.

What does an attacker need to exploit this issue?

An attacker needs to craft a link on the OpenAM domain that uses a vulnerable page and specifies an arbitrary external destination. The resulting trusted-looking OpenAM-domain link can redirect a user to a phishing site.

Is there a documented configuration-based mitigation if an upgrade cannot happen immediately?

The provided information does not identify a configuration workaround. The described flaw is the absence of destination URL validation against allowed lists on the affected endpoints.

CVE-2026-123548: Security vulnerability

Event History

Frequently Asked Questions

Which OpenAM deployments are exposed?

What does an attacker need to exploit this issue?

Is there a documented configuration-based mitigation if an upgrade cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Which OpenAM deployments are exposed?

What does an attacker need to exploit this issue?

Is there a documented configuration-based mitigation if an upgrade cannot happen immediately?