GHSA-rw43-r238-4c7j: OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching

Published Nov 8, 2026

Updated

OpenAM before 16.1.4 contains an open redirect vulnerability that allows remote attackers to redirect users after SAML 1.x single sign-on by exploiting loose trusted-partner destination matching. Attackers can craft links to /SAMLAwareServlet or /SAMLPOSTProfileServlet with a destination host resembling a trusted partner to send authenticated users to attacker-controlled phishing sites.

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

OpenAM versions before 16.1.4 are affected where SAML 1.x single sign-on uses trusted-partner destination matching. The vulnerable redirect endpoints are /SAMLAwareServlet and /SAMLPOSTProfileServlet.

What does an attacker need to exploit this issue?

An attacker can remotely craft a link to a vulnerable SAML endpoint with a destination host that resembles a trusted partner. Successful abuse redirects an authenticated user after SAML 1.x single sign-on to an attacker-controlled site.

What is the immediate mitigation if upgrading is not yet possible?

The provided information does not identify a workaround other than updating to 16.1.4 or later. Prioritize restricting or reviewing access to the affected SAML endpoints and trusted-partner destination handling where operationally possible.

GHSA-rw43-r238-4c7j: OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the immediate mitigation if upgrading is not yet possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the immediate mitigation if upgrading is not yet possible?