CVE-2026-121825

Name of the Vulnerable Software and Affected Versions OpenAM (OpenAM Consortium Edition) versions prior to 14.0.6

Description An open redirect issue exists in the Liberty ID-FF service provider single sign-on flow. The /preLogin endpoint uses the goto parameter to store the RelayState of the Liberty ID-FF authentication request without proper validation. After a user completes the single sign-on process at the identity provider, the assertion consumer service redirects the browser to the value stored in goto. A remote unauthenticated attacker can use a crafted URL to redirect authenticated users to an arbitrary website, potentially facilitating phishing attacks. This issue only affects deployments where a Liberty ID-FF hosted service provider is configured, as it is not enabled by default.

Recommendations Update to version 14.0.6. Restrict access to the /preLogin endpoint if Liberty ID-FF is not required.