GHSA-mgwg-24cx-c8w3: OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages

Published Nov 8, 2026

Updated

OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed lists. Attackers can craft OpenAM-domain links that send users to arbitrary external sites for phishing.

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which OpenAM deployments are affected?

OpenIdentityPlatform OpenAM versions before 16.1.4 are affected. The issue is present in WS-Federation logout, SAML v2.0 logout and name-identifier management, the SAML v2.0 identity provider finder, and some authentication pages.

What does an attacker need to exploit this issue?

An attacker needs to craft a link using the OpenAM domain that directs a user to one of the affected pages with an arbitrary external destination. This can be used to make phishing links appear to originate from a trusted OpenAM domain.

What should be done if upgrading is not immediately possible?

The provided information does not identify a workaround. Prioritize upgrading to 16.1.4 or later and treat unexpected OpenAM-domain links, especially logout, SAML, WS-Federation, and authentication links, as potentially unsafe.

GHSA-mgwg-24cx-c8w3: OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages

Event History

Frequently Asked Questions

Which OpenAM deployments are affected?

What does an attacker need to exploit this issue?

What should be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which OpenAM deployments are affected?

What does an attacker need to exploit this issue?

What should be done if upgrading is not immediately possible?