CVE-2026-121825 · Package
NO FIX YET · SEE WHAT TO DO
OpenAM Consortium Edition 14.0.5 and earlier stores the goto parameter of /preLogin as the Liberty ID-FF RelayState without validation, then redirects the browser to it after sign-in. An attacker can send a crafted link that bounces an authenticated user to any website, which can be used for phishing.
first public Oct 22, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only deployments where a Liberty ID-FF hosted service provider is configured are affected, and Liberty ID-FF is off by default. Teams running OpenAM Consortium Edition 14.0.5 or earlier with that feature enabled should review it; those without it can skip the Liberty ID-FF path.
Not affected if default-config, liberty-idff-disabled
Who cares openam, self-hosted, sso
14.0.5 and earlier are affected.14.0.6, which disables the legacy Liberty ID-FF endpoints.OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier contains an open redirect vulnerability (CWE-601) in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without validation, and after the user completes single sign-on at the identity provider, the assertion consumer service redirects the browser to that value. A remote unauthenticated attacker can induce a user to access a crafted URL and, after the user authenticates, redirect the user to an arbitrary website, which may be used for phishing. Only deployments in which a Liberty ID-FF hosted service provider is configured are affected; Liberty ID-FF is not configured by default. This issue is fixed in 14.0.6, which disables the legacy Liberty ID-FF endpoints.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.