---
id: "CVE-2026-121825"
page: "https://infrastack.ai/live/CVE-2026-121825"
kind: "vulnerability"
aliases: ["CVE-2026-121825"]
title: "OpenAM: open redirect after single sign-on enables phishing via goto parameter"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["openam", "package", "self-hosted", "sso"]
not_affected_if: ["default-config", "liberty-idff-disabled"]
published_at: "2026-11-09T03:16:36+00:00"
first_seen_at: "2026-11-09T03:24:19+00:00"
updated_at: "2026-11-09T03:26:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121825", "first_seen_at": "2026-11-09T03:24:19+00:00"}]
exploit_sources: []
---

# OpenAM: open redirect after single sign-on enables phishing via goto parameter

Link for people: https://infrastack.ai/live/CVE-2026-121825 (this .md is for agents)

OpenAM Consortium Edition 14.0.5 and earlier stores the goto parameter of /preLogin as the Liberty ID-FF RelayState without validation, then redirects the browser to it after sign-in. An attacker can send a crafted link that bounces an authenticated user to any website, which can be used for phishing.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether a Liberty ID-FF hosted service provider is configured in the OpenAM deployment; the sources say it is not configured by default.
- Check the OpenAM version in use; versions `14.0.5` and earlier are affected.

## Fix

- OpenAM Consortium Edition: move to `14.0.6`, which disables the legacy Liberty ID-FF endpoints.

## Timeline

- 2026-11-09T03:24:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121825

## Documents

- [advisory] Vendor advisory: github.com https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8

## From the sources

OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier contains an open redirect vulnerability (CWE-601) in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without validation, and after the user completes single sign-on at the identity provider, the assertion consumer service redirects the browser to that value. A remote unauthenticated attacker can induce a user to access a crafted URL and, after the user authenticates, redirect the user to an arbitrary website, which may be used for phishing. Only deployments in which a Liberty ID-FF hosted service provider is configured are affected; Liberty ID-FF is not configured by default. This issue is fixed in 14.0.6, which disables the legacy Liberty ID-FF endpoints.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_