Medium severity4.7NVD Advisory· Published Nov 8, 2026

CVE-2026-123541

Description

OpenAM before 16.1.4 contains an open redirect vulnerability that allows remote attackers to redirect users after SAML 1.x single sign-on by exploiting loose trusted-partner destination matching. Attackers can craft links to /SAMLAwareServlet or /SAMLPOSTProfileServlet with a destination host resembling a trusted partner to send authenticated users to attacker-controlled phishing sites.

Affected products

Openidentityplatform/Openamllm-fuzzy
Range: <16.1.4

Patches

Vulnerability mechanics

References

github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-rw43-r238-4c7jnvd
www.vulncheck.com/advisories/openam-before-16.1.4-open-redirect-via-saml-1-x-trusted-partner-matchingnvd

News mentions

No linked articles in our index yet.

cvss	0.306
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000