{"id":"CVE-2026-121825","kind":"vulnerability","aliases":["CVE-2026-121825"],"related":[],"title":"OpenAM: open redirect after single sign-on enables phishing via goto parameter","description":"OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier contains an open redirect vulnerability (CWE-601) in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without validation, and after the user completes single sign-on at the identity provider, the assertion consumer service redirects the browser to that value. A remote unauthenticated attacker can induce a user to access a crafted URL and, after the user authenticates, redirect the user to an arbitrary website, which may be used for phishing. Only deployments in which a Liberty ID-FF hosted service provider is configured are affected; Liberty ID-FF is not configured by default. This issue is fixed in 14.0.6, which disables the legacy Liberty ID-FF endpoints.","summary":"OpenAM Consortium Edition 14.0.5 and earlier stores the goto parameter of /preLogin as the Liberty ID-FF RelayState without validation, then redirects the browser to it after sign-in. An attacker can send a crafted link that bounces an authenticated user to any website, which can be used for phishing.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["openam","package","self-hosted","sso"],"not_affected_if":["default-config","liberty-idff-disabled"],"how_to_check":"- Check whether a Liberty ID-FF hosted service provider is configured in the OpenAM deployment; the sources say it is not configured by default.\n- Check the OpenAM version in use; versions `14.0.5` and earlier are affected.","fix":"- OpenAM Consortium Edition: move to `14.0.6`, which disables the legacy Liberty ID-FF endpoints.","status":"open","published_at":"2026-11-09T03:16:36+00:00","first_seen_at":"2026-11-09T03:24:19+00:00","triaged_at":"2026-11-09T03:26:23+00:00","updated_at":"2026-11-09T03:26:23+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T03:26:23Z","model":"claude-haiku-5-5","output":{"fix":"- OpenAM Consortium Edition: move to `14.0.6`, which disables the legacy Liberty ID-FF endpoints.","reach":"internet","title":"OpenAM: open redirect after single sign-on enables phishing via goto parameter","impact":"low","summary":"OpenAM Consortium Edition 14.0.5 and earlier stores the goto parameter of /preLogin as the Liberty ID-FF RelayState without validation, then redirects the browser to it after sign-in. An attacker can send a crafted link that bounces an authenticated user to any website, which can be used for phishing.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openam","sso","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"users redirected to attacker site for phishing after sign-in","analyst_note":"","how_to_check":"- Check whether a Liberty ID-FF hosted service provider is configured in the OpenAM deployment; the sources say it is not configured by default.\n- Check the OpenAM version in use; versions `14.0.5` and earlier are affected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","liberty-idff-disabled"],"who_is_affected":"Only deployments where a Liberty ID-FF hosted service provider is configured are affected, and Liberty ID-FF is off by default. Teams running OpenAM Consortium Edition 14.0.5 or earlier with that feature enabled should review it; those without it can skip the Liberty ID-FF path.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000768,"input_tokens":4775,"output_tokens":581,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121825':16A,19A '-2026':15A,18A '-601':91C '/prelogin':37B,110C '14.0.5':29B,82C '14.0.6':211C 'access':159C 'affect':196C 'arbitrari':173C 'assert':141C 'attack':58B,153C 'authent':67B,123C,167C 'bounc':65B 'browser':50B,146C 'complet':131C 'configur':194C,203C 'consortium':27B,80C 'consum':142C 'contain':85C 'craft':62B,161C 'cve':14A,17A 'cwe':90C 'default':205C 'deploy':182C 'disabl':213C 'earlier':31B,84C 'edit':28B,81C 'enabl':9A 'endpoint':111C,220C 'ff':43B,97C,122C,189C,200C,219C 'fix':209C 'flow':104C 'goto':12A,34B,106C 'host':24B,190C 'id':42B,96C,121C,188C,199C,218C 'id-ff':41B,95C,120C,187C,198C,217C 'ident':138C 'induc':155C 'issu':207C 'legaci':215C 'liberti':40B,94C,119C,186C,197C,216C 'link':63B 'may':176C 'open':2A,87C 'openam':1A,20B,26B,78C,79C 'packag':21B 'paramet':13A,35B,107C 'phish':10A,77B,180C 'provid':99C,139C,192C 'redirect':3A,48B,88C,144C,168C 'relayst':44B,116C 'remot':151C 'request':124C 'self':23B 'self-host':22B 'send':60B 'servic':98C,143C,191C 'sign':7A,55B,102C,134C 'sign-in':54B 'sign-on':6A,101C,133C 'singl':5A,100C,132C 'sso':25B 'store':32B,113C 'unauthent':152C 'url':162C 'use':75B,178C 'user':68B,130C,157C,166C,170C 'valid':46B,126C 'valu':149C 'via':11A 'vulner':89C 'websit':71B,174C 'without':45B,125C","nicknames":[],"mitigations":[],"who_affected":"Only deployments where a Liberty ID-FF hosted service provider is configured are affected, and Liberty ID-FF is off by default. Teams running OpenAM Consortium Edition 14.0.5 or earlier with that feature enabled should review it; those without it can skip the Liberty ID-FF path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","openam","package","selfhosted","sso"],"campaign_type":null,"search_a":"'-121825':16A,19A '-2026':15A,18A 'cve':14A,17A 'enabl':9A 'goto':12A 'open':2A 'openam':1A 'paramet':13A 'phish':10A 'redirect':3A 'sign':7A 'sign-on':6A 'singl':5A 'via':11A","search_b":"'/prelogin':37B '14.0.5':29B 'attack':58B 'authent':67B 'bounc':65B 'browser':50B 'consortium':27B 'craft':62B 'earlier':31B 'edit':28B 'ff':43B 'goto':34B 'host':24B 'id':42B 'id-ff':41B 'liberti':40B 'link':63B 'openam':20B,26B 'packag':21B 'paramet':35B 'phish':77B 'redirect':48B 'relayst':44B 'self':23B 'self-host':22B 'send':60B 'sign':55B 'sign-in':54B 'sso':25B 'store':32B 'use':75B 'user':68B 'valid':46B 'websit':71B 'without':45B","search_c":"'-601':91C '/prelogin':110C '14.0.5':82C '14.0.6':211C 'access':159C 'affect':196C 'arbitrari':173C 'assert':141C 'attack':153C 'authent':123C,167C 'browser':146C 'complet':131C 'configur':194C,203C 'consortium':80C 'consum':142C 'contain':85C 'craft':161C 'cwe':90C 'default':205C 'deploy':182C 'disabl':213C 'earlier':84C 'edit':81C 'endpoint':111C,220C 'ff':97C,122C,189C,200C,219C 'fix':209C 'flow':104C 'goto':106C 'host':190C 'id':96C,121C,188C,199C,218C 'id-ff':95C,120C,187C,198C,217C 'ident':138C 'induc':155C 'issu':207C 'legaci':215C 'liberti':94C,119C,186C,197C,216C 'may':176C 'open':87C 'openam':78C,79C 'paramet':107C 'phish':180C 'provid':99C,139C,192C 'redirect':88C,144C,168C 'relayst':116C 'remot':151C 'request':124C 'servic':98C,143C,191C 'sign':102C,134C 'sign-on':101C,133C 'singl':100C,132C 'store':113C 'unauthent':152C 'url':162C 'use':178C 'user':130C,157C,166C,170C 'valid':126C 'valu':149C 'vulner':89C 'websit':174C 'without':125C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-22T08:43:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"37c6977f-aa3f-41e8-829b-3e8ff4df3c14","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121825","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121825","severity":null,"published_at":"2026-11-09T03:16:36+00:00","modified_at":"2026-11-09T03:16:36+00:00","first_seen_at":"2026-11-09T03:24:19+00:00","fetched_at":"2026-11-09T03:24:19+00:00","note":null}],"documents":[{"id":99251,"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T08:43:34+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}