Open Redirect Vulnerability in OpenAM by OpenAM Consortium
CVE-2026-121825

5.1MEDIUM

Key Information:

Vendor

Openam Consortium

Status
Openam (openam Consortium Edition)
Vendor
CVE Published:
9 November 2026

What is CVE-2026-121825?

OpenAM prior to version 14.0.6 contains an open redirect vulnerability within the Liberty ID-FF service provider single sign-on process. This occurs because the 'goto' parameter in the /preLogin endpoint is used as the RelayState in the authentication request without sufficient validation. An attacker could craft a malicious URL that redirects to an arbitrary site post-authentication, potentially facilitating phishing attacks. Notably, only deployments specifically configured with the Liberty ID-FF service provider are affected, as it is not enabled by default. The vulnerability was addressed in version 14.0.6, which disables these legacy endpoints.

Affected Version(s)

OpenAM (OpenAM Consortium Edition) 14.0.0 < 14.0.6

References

https://openam-jp.github.io/Advisories/CVE-2026-121825/
vendor-advisory
https://github.com/OpenIdentityPlatform/OpenAM/security/a...
related

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arittro Sarkar
.