{"id":"CVE-2026-123547","kind":"vulnerability","aliases":["CVE-2026-123547"],"related":[],"title":"OpenAM: open redirect via unchecked RelayState sends users to phishing sites","description":"OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrlList is configured. Attackers can craft single sign-on links with a malicious RelayState to send users from the trusted OpenAM origin to phishing sites and bypass URL filters.","summary":"OpenAM before 16.1.4 does not check the RelayState parameter when no relayStateUrlList is configured. An attacker can craft a single sign-on link that sends users from the trusted OpenAM site to a phishing page.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["openam","other","self-hosted","single-sign-on"],"not_affected_if":["patched-version","relaystateurllist-configured"],"how_to_check":"- Check the installed OpenAM version and see whether it is below `16.1.4`.\n- Check whether `relayStateUrlList` is configured in the OpenAM settings; the flaw applies when it is not set.","fix":"- Move OpenAM to `16.1.4` or later.","status":"open","published_at":"2026-11-08T02:16:45+00:00","first_seen_at":"2026-11-08T02:21:11+00:00","triaged_at":"2026-11-08T02:25:33+00:00","updated_at":"2026-11-08T02:25:33+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-08T02:25:33Z","model":"claude-haiku-5-5","output":{"fix":"- Move OpenAM to `16.1.4` or later.","reach":"internet","title":"OpenAM: open redirect via unchecked RelayState sends users to phishing sites","impact":"low","summary":"OpenAM before 16.1.4 does not check the RelayState parameter when no relayStateUrlList is configured. An attacker can craft a single sign-on link that sends users from the trusted OpenAM site to a phishing page.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openam","single-sign-on","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"users are redirected to phishing sites from the trusted origin","analyst_note":"","how_to_check":"- Check the installed OpenAM version and see whether it is below `16.1.4`.\n- Check whether `relayStateUrlList` is configured in the OpenAM settings; the flaw applies when it is not set.","plain_action":"","needs_analyst":false,"not_affected_if":["relaystateurllist-configured","patched-version"],"who_is_affected":"OpenAM instances below 16.1.4 that do not set a relayStateUrlList are exposed, since RelayState is then unchecked. Teams running OpenAM for single sign-on are the ones to look at; deployments that restrict RelayState through relayStateUrlList are not affected by this flaw as described.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000689,"input_tokens":4282,"output_tokens":521,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123547':14A,17A '-2026':13A,16A '16.1.4':28B,64C 'allow':71C 'attack':41B,72C,88C 'bypass':112C 'check':31B 'configur':39B,87C 'contain':65C 'craft':43B,90C 'cve':12A,15A 'extern':77C 'filter':114C 'host':22B 'link':49B,95C 'malici':98C 'open':2A,67C 'openam':1A,18B,26B,56B,62C,106C 'origin':107C 'page':61B 'paramet':34B 'phish':10A,60B,109C 'redirect':3A,68C,74C 'relayst':6A,33B,80C,99C 'relaystateurllist':37B,85C 'self':21B 'self-host':20B 'send':7A,51B,101C 'sign':25B,47B,93C 'sign-on':46B,92C 'singl':24B,45B,91C 'single-sign-on':23B 'site':11A,57B,78C,110C 'trust':55B,105C 'uncheck':5A,82C 'url':113C 'user':8A,52B,75C,102C 'via':4A 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"OpenAM instances below 16.1.4 that do not set a relayStateUrlList are exposed, since RelayState is then unchecked. Teams running OpenAM for single sign-on are the ones to look at; deployments that restrict RelayState through relayStateUrlList are not affected by this flaw as described.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","openam","other","selfhosted","singlesignon"],"campaign_type":null,"search_a":"'-123547':14A,17A '-2026':13A,16A 'cve':12A,15A 'open':2A 'openam':1A 'phish':10A 'redirect':3A 'relayst':6A 'send':7A 'site':11A 'uncheck':5A 'user':8A 'via':4A","search_b":"'16.1.4':28B 'attack':41B 'check':31B 'configur':39B 'craft':43B 'host':22B 'link':49B 'openam':18B,26B,56B 'page':61B 'paramet':34B 'phish':60B 'relayst':33B 'relaystateurllist':37B 'self':21B 'self-host':20B 'send':51B 'sign':25B,47B 'sign-on':46B 'singl':24B,45B 'single-sign-on':23B 'site':57B 'trust':55B 'user':52B","search_c":"'16.1.4':64C 'allow':71C 'attack':72C,88C 'bypass':112C 'configur':87C 'contain':65C 'craft':90C 'extern':77C 'filter':114C 'link':95C 'malici':98C 'open':67C 'openam':62C,106C 'origin':107C 'phish':109C 'redirect':68C,74C 'relayst':80C,99C 'relaystateurllist':85C 'send':101C 'sign':93C 'sign-on':92C 'singl':91C 'site':78C,110C 'trust':105C 'uncheck':82C 'url':113C 'user':75C,102C 'vulner':69C","first_public_at":"2026-10-22T09:01:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123547","severity":null,"published_at":"2026-11-08T02:16:45+00:00","modified_at":"2026-11-08T02:16:45+00:00","first_seen_at":"2026-11-08T02:21:11+00:00","fetched_at":"2026-11-08T02:21:11+00:00","note":null}],"documents":[{"id":99243,"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-fhqm-62hv-4phw","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T09:01:37+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99244,"url":"https://www.vulncheck.com/advisories/openam-before-16.1.4-open-redirect-via-saml-2.0-relaystate","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}