---
id: "CVE-2026-123548"
page: "https://infrastack.ai/live/CVE-2026-123548"
kind: "vulnerability"
aliases: ["CVE-2026-123548"]
title: "OpenAM: open redirect in logout and SAML pages enables phishing"
severity: "medium"
cvss: 4.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["openam", "other", "saml", "self-hosted", "sso", "ws-federation"]
not_affected_if: ["fixed-version", "openam-not-deployed"]
published_at: "2026-11-08T02:16:46+00:00"
first_seen_at: "2026-11-08T02:21:11+00:00"
updated_at: "2026-11-08T02:25:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123548", "first_seen_at": "2026-11-08T02:21:11+00:00"}]
exploit_sources: []
---

# OpenAM: open redirect in logout and SAML pages enables phishing

Link for people: https://infrastack.ai/live/CVE-2026-123548 (this .md is for agents)

OpenIdentityPlatform OpenAM before 16.1.4 fails to check destination URLs on several logout, SAML and authentication pages. An attacker can craft links on the OpenAM domain that send users to arbitrary external sites for phishing.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenAM version and see whether it is below `16.1.4`
- Review whether WS-Federation logout, SAML v2.0 logout, or the SAML v2.0 identity provider finder pages are in use

## Fix

- OpenIdentityPlatform OpenAM: upgrade to `16.1.4` or later

## Timeline

- 2026-11-08T02:21:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123548

## Documents

- [advisory] Vendor advisory: github.com https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-mgwg-24cx-c8w3
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openam-before-16.1.4-open-redirect-via-ws-federation-and-saml-2.0-pages

## From the sources

OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed lists. Attackers can craft OpenAM-domain links that send users to arbitrary external sites for phishing.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_