CVE-2026-123546 · Infrastructure
NO FIX YET · SEE WHAT TO DO
OpenAM before 16.1.4 lets remote attackers control post-login and logout destinations through the goto and gotoOnFail parameters. Attackers can craft links that redirect victims to phishing sites or run script in the XUI to steal session cookies.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any OpenAM deployment older than 16.1.4 that serves login or logout pages can be targeted with crafted links. The sources do not say whether any particular configuration is required, so treat all versions before 16.1.4 as in scope. Teams that run no OpenAM instance can skip it.
Not affected if openam-16.1.4-or-later
Who cares identity, openam, self-hosted
16.1.4 or laterOpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run script in the XUI to steal session cookies.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.