---
id: "CVE-2026-123546"
page: "https://infrastack.ai/live/CVE-2026-123546"
kind: "vulnerability"
aliases: ["CVE-2026-123546"]
title: "OpenAM: login and logout redirects let attackers steal session cookies"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["identity", "infrastructure", "openam", "self-hosted"]
not_affected_if: ["openam-16.1.4-or-later"]
published_at: "2026-11-08T02:16:45+00:00"
first_seen_at: "2026-11-08T02:21:10+00:00"
updated_at: "2026-11-08T02:25:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123546", "first_seen_at": "2026-11-08T02:21:10+00:00"}]
exploit_sources: []
---

# OpenAM: login and logout redirects let attackers steal session cookies

Link for people: https://infrastack.ai/live/CVE-2026-123546 (this .md is for agents)

OpenAM before 16.1.4 lets remote attackers control post-login and logout destinations through the goto and gotoOnFail parameters. Attackers can craft links that redirect victims to phishing sites or run script in the XUI to steal session cookies.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenAM version in use against the fixed range below

## Fix

- OpenAM: move to `16.1.4` or later

## Timeline

- 2026-11-08T02:21:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123546

## Documents

- [advisory] Vendor advisory: github.com https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2gwf-vxp5-f9v2
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openam-before-16.1.4-open-redirect-and-xss-via-goto-and-gotoonfail

## From the sources

OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run script in the XUI to steal session cookies.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_