---
id: "CVE-2026-123547"
page: "https://infrastack.ai/live/CVE-2026-123547"
kind: "vulnerability"
aliases: ["CVE-2026-123547"]
title: "OpenAM: open redirect via unchecked RelayState sends users to phishing sites"
severity: "medium"
cvss: 4.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["openam", "other", "self-hosted", "single-sign-on"]
not_affected_if: ["patched-version", "relaystateurllist-configured"]
published_at: "2026-11-08T02:16:45+00:00"
first_seen_at: "2026-11-08T02:21:11+00:00"
updated_at: "2026-11-08T02:25:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123547", "first_seen_at": "2026-11-08T02:21:11+00:00"}]
exploit_sources: []
---

# OpenAM: open redirect via unchecked RelayState sends users to phishing sites

Link for people: https://infrastack.ai/live/CVE-2026-123547 (this .md is for agents)

OpenAM before 16.1.4 does not check the RelayState parameter when no relayStateUrlList is configured. An attacker can craft a single sign-on link that sends users from the trusted OpenAM site to a phishing page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenAM version and see whether it is below `16.1.4`.
- Check whether `relayStateUrlList` is configured in the OpenAM settings; the flaw applies when it is not set.

## Fix

- Move OpenAM to `16.1.4` or later.

## Timeline

- 2026-11-08T02:21:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123547

## Documents

- [advisory] Vendor advisory: github.com https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-fhqm-62hv-4phw
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openam-before-16.1.4-open-redirect-via-saml-2.0-relaystate

## From the sources

OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrlList is configured. Attackers can craft single sign-on links with a malicious RelayState to send users from the trusted OpenAM origin to phishing sites and bypass URL filters.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_