CVE-2026-81029

Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 2.0.0

Description The software accepts a caller-supplied post-authentication redirect target and appends the issued token to it. The SamlLoginServlet reads the callback request parameter and stores it in the HTTP session without validating it against registered destinations. Subsequently, the assertion consumer servlet formats this value into a URL containing the issued JWT, account email, and name before performing the redirect. The OIDC and OAuth2 handlers follow a similar pattern using their own redirect parameters and identity tokens. An attacker can specify a destination they control, causing the server to send a valid token to that destination upon successful login, allowing the attacker to take control of the user account.

Recommendations Update to version 2.0.0.