CVE-2026-105118

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3

Description An open redirect issue exists where unauthenticated attackers can redirect users by providing an unverified id token hint to the '/oauth2/connect/endSession' endpoint. By specifying any realm client in a forged hint, attackers can redirect victims to any registered post-logout URI, which can be used to facilitate phishing attacks by leveraging the trust associated with the OpenAM host.

Recommendations Update to version 16.1.3 or later. As a temporary mitigation, restrict access to the '/oauth2/connect/endSession' endpoint or avoid using the id token hint parameter until the update is applied.