{"id":"CVE-2026-123548","kind":"vulnerability","aliases":["CVE-2026-123548"],"related":[],"title":"OpenAM: open redirect in logout and SAML pages enables phishing","description":"OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed lists. Attackers can craft OpenAM-domain links that send users to arbitrary external sites for phishing.","summary":"OpenIdentityPlatform OpenAM before 16.1.4 fails to check destination URLs on several logout, SAML and authentication pages. An attacker can craft links on the OpenAM domain that send users to arbitrary external sites for phishing.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["openam","other","saml","self-hosted","sso","ws-federation"],"not_affected_if":["fixed-version","openam-not-deployed"],"how_to_check":"- Check the installed OpenAM version and see whether it is below `16.1.4`\n- Review whether WS-Federation logout, SAML v2.0 logout, or the SAML v2.0 identity provider finder pages are in use","fix":"- OpenIdentityPlatform OpenAM: upgrade to `16.1.4` or later","status":"open","published_at":"2026-11-08T02:16:46+00:00","first_seen_at":"2026-11-08T02:21:11+00:00","triaged_at":"2026-11-08T02:25:31+00:00","updated_at":"2026-11-08T02:25:31+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-08T02:25:31Z","model":"claude-haiku-5-5","output":{"fix":"- OpenIdentityPlatform OpenAM: upgrade to `16.1.4` or later","reach":"internet","title":"OpenAM: open redirect in logout and SAML pages enables phishing","impact":"low","summary":"OpenIdentityPlatform OpenAM before 16.1.4 fails to check destination URLs on several logout, SAML and authentication pages. An attacker can craft links on the OpenAM domain that send users to arbitrary external sites for phishing.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openam","sso","saml","ws-federation","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"users are redirected to attacker-chosen phishing sites from the OpenAM domain","analyst_note":"","how_to_check":"- Check the installed OpenAM version and see whether it is below `16.1.4`\n- Review whether WS-Federation logout, SAML v2.0 logout, or the SAML v2.0 identity provider finder pages are in use","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","openam-not-deployed"],"who_is_affected":"Organizations running OpenIdentityPlatform OpenAM before 16.1.4 as their access management or single sign-on server are exposed, especially where WS-Federation, SAML v2.0 logout or identity provider finder features are used. Deployments on a fixed version or not running OpenAM can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000708,"input_tokens":4308,"output_tokens":555,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123548':13A,16A '-2026':12A,15A '16.1.4':30B,64C 'allow':97C 'arbitrari':56B,110C 'attack':44B,99C 'authent':41B,89C 'check':33B,93C 'contain':65C 'craft':46B,101C 'cve':11A,14A 'destin':34B,94C 'domain':51B,104C 'enabl':9A 'extern':57B,111C 'fail':31B 'feder':26B,72C 'finder':86C 'host':22B 'ident':84C 'identifi':80C 'link':47B,105C 'list':98C 'logout':5A,38B,73C,76C 'manag':81C 'name':79C 'name-identifi':78C 'open':2A,67C 'openam':1A,17B,28B,50B,62C,103C 'openam-domain':102C 'openidentityplatform':27B,61C 'page':8A,42B,90C 'phish':10A,60B,114C 'provid':85C 'redirect':3A,68C 'saml':7A,19B,39B,74C,82C 'self':21B 'self-host':20B 'send':53B,107C 'sever':37B 'site':58B,112C 'sso':23B 'url':35B,95C 'user':54B,108C 'v2.0':75C,83C 'ws':25B,71C 'ws-feder':24B,70C","nicknames":[],"mitigations":[],"who_affected":"Organizations running OpenIdentityPlatform OpenAM before 16.1.4 as their access management or single sign-on server are exposed, especially where WS-Federation, SAML v2.0 logout or identity provider finder features are used. Deployments on a fixed version or not running OpenAM can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","openam","other","saml","selfhosted","sso","wsfederation"],"campaign_type":null,"search_a":"'-123548':13A,16A '-2026':12A,15A 'cve':11A,14A 'enabl':9A 'logout':5A 'open':2A 'openam':1A 'page':8A 'phish':10A 'redirect':3A 'saml':7A","search_b":"'16.1.4':30B 'arbitrari':56B 'attack':44B 'authent':41B 'check':33B 'craft':46B 'destin':34B 'domain':51B 'extern':57B 'fail':31B 'feder':26B 'host':22B 'link':47B 'logout':38B 'openam':17B,28B,50B 'openidentityplatform':27B 'page':42B 'phish':60B 'saml':19B,39B 'self':21B 'self-host':20B 'send':53B 'sever':37B 'site':58B 'sso':23B 'url':35B 'user':54B 'ws':25B 'ws-feder':24B","search_c":"'16.1.4':64C 'allow':97C 'arbitrari':110C 'attack':99C 'authent':89C 'check':93C 'contain':65C 'craft':101C 'destin':94C 'domain':104C 'extern':111C 'feder':72C 'finder':86C 'ident':84C 'identifi':80C 'link':105C 'list':98C 'logout':73C,76C 'manag':81C 'name':79C 'name-identifi':78C 'open':67C 'openam':62C,103C 'openam-domain':102C 'openidentityplatform':61C 'page':90C 'phish':114C 'provid':85C 'redirect':68C 'saml':74C,82C 'send':107C 'site':112C 'url':95C 'user':108C 'v2.0':75C,83C 'ws':71C 'ws-feder':70C","first_public_at":"2026-10-22T08:57:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123548","severity":null,"published_at":"2026-11-08T02:16:46+00:00","modified_at":"2026-11-08T02:16:46+00:00","first_seen_at":"2026-11-08T02:21:11+00:00","fetched_at":"2026-11-08T02:21:11+00:00","note":null}],"documents":[{"id":99245,"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-mgwg-24cx-c8w3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T08:57:58+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99246,"url":"https://www.vulncheck.com/advisories/openam-before-16.1.4-open-redirect-via-ws-federation-and-saml-2.0-pages","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}