{"id":"CVE-2026-123546","kind":"vulnerability","aliases":["CVE-2026-123546"],"related":[],"title":"OpenAM: login and logout redirects let attackers steal session cookies","description":"OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run script in the XUI to steal session cookies.","summary":"OpenAM before 16.1.4 lets remote attackers control post-login and logout destinations through the goto and gotoOnFail parameters. Attackers can craft links that redirect victims to phishing sites or run script in the XUI to steal session cookies.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","infrastructure","openam","self-hosted"],"not_affected_if":["openam-16.1.4-or-later"],"how_to_check":"- Check the OpenAM version in use against the fixed range below","fix":"- OpenAM: move to `16.1.4` or later","status":"open","published_at":"2026-11-08T02:16:45+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","triaged_at":"2026-11-08T02:25:08+00:00","updated_at":"2026-11-08T02:25:08+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-08T02:25:08Z","model":"claude-haiku-5-5","output":{"fix":"- OpenAM: move to `16.1.4` or later","reach":"internet","title":"OpenAM: login and logout redirects let attackers steal session cookies","impact":"medium","summary":"OpenAM before 16.1.4 lets remote attackers control post-login and logout destinations through the goto and gotoOnFail parameters. Attackers can craft links that redirect victims to phishing sites or run script in the XUI to steal session cookies.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["openam","self-hosted","identity"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Session cookies stolen via script run in the login interface","analyst_note":"Confirm whether a default configuration exposes goto and gotoOnFail, using the vendor advisory on github.com linked from the signal.","how_to_check":"- Check the OpenAM version in use against the fixed range below\n- unknown for other settings: the sources do not say which configuration exposes the goto and gotoOnFail parameters","plain_action":"","needs_analyst":true,"not_affected_if":["openam-16.1.4-or-later"],"who_is_affected":"Any OpenAM deployment older than 16.1.4 that serves login or logout pages can be targeted with crafted links. The sources do not say whether any particular configuration is required, so treat all versions before 16.1.4 as in scope. Teams that run no OpenAM instance can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.0007,"input_tokens":4282,"output_tokens":544,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123546':13A,16A '-2026':12A,15A '16.1.4':25B,64C 'allow':76C 'attack':7A,28B,42B,78C,93C 'contain':65C 'control':29B,80C 'cooki':10A,61B,116C 'craft':44B,95C 'cross':71C 'cross-sit':70C 'cve':11A,14A 'destin':35B,86C 'goto':38B,89C 'gotoonfail':40B,91C 'host':22B 'ident':17B 'infrastructur':18B 'let':6A,26B 'link':45B,100C 'login':2A,32B,83C,97C 'logout':4A,34B,85C,99C 'open':67C 'openam':1A,19B,23B,62C,96C 'paramet':41B,92C 'phish':50B,105C 'post':31B,82C 'post-login':30B,81C 'redirect':5A,47B,68C,102C 'remot':27B,77C 'run':53B,108C 'script':54B,73C,109C 'self':21B 'self-host':20B 'session':9A,60B,115C 'site':51B,72C,106C 'steal':8A,59B,114C 'via':87C 'victim':48B,103C 'vulner':74C 'xui':57B,112C","nicknames":[],"mitigations":[],"who_affected":"Any OpenAM deployment older than 16.1.4 that serves login or logout pages can be targeted with crafted links. The sources do not say whether any particular configuration is required, so treat all versions before 16.1.4 as in scope. Teams that run no OpenAM instance can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["identity","infrastructure","medium","openam","selfhosted"],"campaign_type":null,"search_a":"'-123546':13A,16A '-2026':12A,15A 'attack':7A 'cooki':10A 'cve':11A,14A 'let':6A 'login':2A 'logout':4A 'openam':1A 'redirect':5A 'session':9A 'steal':8A","search_b":"'16.1.4':25B 'attack':28B,42B 'control':29B 'cooki':61B 'craft':44B 'destin':35B 'goto':38B 'gotoonfail':40B 'host':22B 'ident':17B 'infrastructur':18B 'let':26B 'link':45B 'login':32B 'logout':34B 'openam':19B,23B 'paramet':41B 'phish':50B 'post':31B 'post-login':30B 'redirect':47B 'remot':27B 'run':53B 'script':54B 'self':21B 'self-host':20B 'session':60B 'site':51B 'steal':59B 'victim':48B 'xui':57B","search_c":"'16.1.4':64C 'allow':76C 'attack':78C,93C 'contain':65C 'control':80C 'cooki':116C 'craft':95C 'cross':71C 'cross-sit':70C 'destin':86C 'goto':89C 'gotoonfail':91C 'link':100C 'login':83C,97C 'logout':85C,99C 'open':67C 'openam':62C,96C 'paramet':92C 'phish':105C 'post':82C 'post-login':81C 'redirect':68C,102C 'remot':77C 'run':108C 'script':73C,109C 'session':115C 'site':72C,106C 'steal':114C 'via':87C 'victim':103C 'vulner':74C 'xui':112C","first_public_at":"2026-10-22T09:06:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123546","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123546","severity":null,"published_at":"2026-11-08T02:16:45+00:00","modified_at":"2026-11-08T02:16:45+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","fetched_at":"2026-11-08T02:21:10+00:00","note":null}],"documents":[{"id":99241,"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2gwf-vxp5-f9v2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T09:06:08+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99242,"url":"https://www.vulncheck.com/advisories/openam-before-16.1.4-open-redirect-and-xss-via-goto-and-gotoonfail","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}