# CVE-2026-105116: OpenAM unencoded SAML values in load-balancer bounce page

Source: https://junglewise.ai/threats/cve-2026-105116-openam-before-16-1-3-contains-a-latent-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-03. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105116 · Severity: medium · CVSS 6.1 · Published 2026-10-03

OpenAM is an identity and access management platform used to authenticate users and manage single sign-on in enterprise environments. This vulnerability is a latent cross-site scripting defect in the SAML authentication flow's load-balancer cookie bounce mechanism. Although the flaw exists in the code, an unrelated HTTP 500 error prevents it from being exploitable in released versions; however, if the feature is enabled and the error is fixed, an attacker could craft a request to execute arbitrary scripts in the OpenAM authentication origin.

Technologies: [Open Identity Platform OpenAM](https://junglewise.ai/threats/technologies/openam). Vendors: [Open Identity Platform](https://junglewise.ai/threats/vendors/open-identity-platform).

## Quick answers

**Is CVE-2026-105116 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105116 being exploited in the wild.

**How severe is CVE-2026-105116?** Medium severity, with a CVSS score of 6.1, published 3 October 2026.

**Which products and versions are affected?** Open Identity Platform OpenAM before 16.1.3; Open Identity Platform Openam-Auth-Saml2 16.1.2 and earlier; Open Identity Platform Openam-Federation-Library 16.1.2 and earlier; Open Identity Platform Openam-Server-Only 16.1.2 and earlier.

**Is there a fix for CVE-2026-105116?** Yes: fixed in OpenAM 16.1.3; openam-auth-saml2 16.1.3; openam-federation-library 16.1.3; openam-server-only 16.1.3. Until then: Leave the non-default property com.sun.identity.federation.cookieHashRedirectEnabled unset (the default configuration) unless the load-balancer bounce feature is explicitly needed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105116 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-105116?** Check whether you run Open Identity Platform OpenAM, Open Identity Platform Openam-Auth-Saml2, Open Identity Platform Openam-Federation-Library or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in OpenAM 16.1.3; openam-auth-saml2 16.1.3; openam-federation-library 16.1.3; openam-server-only 16.1.3

Leave the non-default property com.sun.identity.federation.cookieHashRedirectEnabled unset (the default configuration) unless the load-balancer bounce feature is explicitly needed.

## Technical details

The SAML 2.0 and Liberty ID-FF pre-authentication endpoints contain unencoded placement of the SAML message, relay state, and target URL in an auto-submit HTML page used for load-balancer cookie bounces. This is a reflected XSS vulnerability (CWE-79) that requires the non-default property com.sun.identity.federation.cookieHashRedirectEnabled=true to be set; however, an unrelated defect causes an HTTP 500 error before page rendering in all released versions, preventing actual exploitation. The vulnerable code path was fixed in 16.1.3 along with the underlying HTTP 500 issue.

## Affected products

- Open Identity Platform OpenAM before 16.1.3
- Open Identity Platform openam-auth-saml2 16.1.2 and earlier
- Open Identity Platform openam-federation-library 16.1.2 and earlier
- Open Identity Platform openam-server-only 16.1.2 and earlier

## Timeline

- 2026-09-18: disclosed: GitHub Security Advisory GHSA-v796-mg6j-9c5m published
- 2026-10-03: advisory: CVE-2026-105116 assigned and published

## References

- [https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-v796-mg6j-9c5m](https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-v796-mg6j-9c5m)
- [https://www.vulncheck.com/advisories/openam-before-16.1.3-latent-xss-in-saml-load-balancer-cookie-bounce-page](https://www.vulncheck.com/advisories/openam-before-16.1.3-latent-xss-in-saml-load-balancer-cookie-bounce-page)

## Related threats

- [OpenAM default credentials authentication bypass in built-in identities](https://junglewise.ai/threats/cve-2026-123553-openam-before-16-1-4-ships-built-in-identities-in-the-top-level)
- [OpenAM unauthenticated session token disclosure via WebSocket](https://junglewise.ai/threats/cve-2026-123551-openam-from-14-0-0-before-16-1-4-contains-an-information)
- [OpenAM SAML v2.0 service provider authentication bypass](https://junglewise.ai/threats/cve-2026-123550-openam-before-16-1-4-contains-an-authentication-bypass)
- [OpenAM self-registration attribute list enforcement bypass](https://junglewise.ai/threats/cve-2026-123549-openam-before-16-1-4-fails-to-enforce-the-valid-creation)
- [OpenAM open redirect via SAML RelayState](https://junglewise.ai/threats/cve-2026-123547-openam-before-16-1-4-contains-an-open-redirect-vulnerability)