CVE-2026-123546

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.4

Description An open redirect and cross-site scripting issue exists that allows remote attackers to control destinations after login and logout. This is achieved by manipulating the goto and gotoOnFail parameters. Attackers can create malicious login or logout links to redirect users to phishing websites or execute scripts within the XUI to steal session cookies.

Recommendations Update to version 16.1.4 or later. Avoid using the goto and gotoOnFail parameters in login and logout links until the update is applied.