CVE-2026-123547 · Other
NO FIX YET · SEE WHAT TO DO
OpenAM before 16.1.4 does not check the RelayState parameter when no relayStateUrlList is configured. An attacker can craft a single sign-on link that sends users from the trusted OpenAM site to a phishing page.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
OpenAM instances below 16.1.4 that do not set a relayStateUrlList are exposed, since RelayState is then unchecked. Teams running OpenAM for single sign-on are the ones to look at; deployments that restrict RelayState through relayStateUrlList are not affected by this flaw as described.
Not affected if patched-version, relaystateurllist-configured
Who cares openam, self-hosted, single-sign-on
16.1.4.relayStateUrlList is configured in the OpenAM settings; the flaw applies when it is not set.16.1.4 or later.OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrlList is configured. Attackers can craft single sign-on links with a malicious RelayState to send users from the trusted OpenAM origin to phishing sites and bypass URL filters.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.