PT-2026-139829

CVE-2026-123548

Published

2026-11-08

Updated

2026-11-08

Description by

CVSS 3.1

4.7

Medium

MetricsAV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenIdentityPlatform OpenAM versions prior to 16.1.4

Description An open redirect exists because the WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and certain authentication pages fail to validate destination URLs against allowed lists. This allows attackers to create links using the OpenAM domain that redirect users to arbitrary external sites for phishing purposes.

Recommendations Update OpenIdentityPlatform OpenAM to version 16.1.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products