CVE-2026-105118: OpenAM open redirect in end-session endpoint via unverified id_token_hint

CVE-2026-105118 · Severity: medium · CVSS 4.7 · Published 2026-10-03

OpenAM is an identity and access management platform that handles user authentication and authorization. An unauthenticated attacker can craft a malicious link that redirects users to phishing sites by exploiting unverified tokens in the logout endpoint, leveraging the trust associated with the OpenAM server's domain. The victim is not logged out and no credentials are stolen, but the attacker can bypass authentication requirements to send victims to any pre-registered post-logout URI.

Technologies: OpenIdentityPlatform OpenAM. Vendors: OpenIdentityPlatform.

Quick answers

Is CVE-2026-105118 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-105118 being exploited in the wild.
How severe is CVE-2026-105118?
Medium severity, with a CVSS score of 4.7, published 3 October 2026.
Which products and versions are affected?
OpenIdentityPlatform OpenAM before 16.1.3.
Is there a fix for CVE-2026-105118?
Yes: fixed in OpenAM 16.1.3. Until then: Disable Allow Open Dynamic Client Registration in the OAuth2 Provider service and restrict access to the /oauth2/connect/register endpoint at the reverse proxy or firewall. Review and remove any post-logout redirect URIs pointing to domains you do not control, hostnames that no longer resolve to your infrastructure, or third-party sites, as all registered URIs are reachable through a crafted end-session link until the fix is deployed.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-18"},{"kind":"advisory","at":"2026-10-03"},{"kind":"patched","at":"2026-10-03","note":"OpenAM 16.1.3 released with fix"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105118 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-105118?
Check whether you run OpenIdentityPlatform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: OpenAM 16.1.3

Disable Allow Open Dynamic Client Registration in the OAuth2 Provider service and restrict access to the /oauth2/connect/register endpoint at the reverse proxy or firewall. Review and remove any post-logout redirect URIs pointing to domains you do not control, hostnames that no longer resolve to your infrastructure, or third-party sites, as all registered URIs are reachable through a crafted end-session link until the fix is deployed.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-18"},{"kind":"advisory","at":"2026-10-03"},{"kind":"patched","at":"2026-10-03","note":"OpenAM 16.1.3 released with fix"}]

Technical details

The /oauth2/connect/endSession endpoint accepts an id_token_hint parameter without verifying the token's signature, allowing an unauthenticated attacker to specify any client identity and redirect to that client's registered post-logout URIs. The attack requires the target URI to already be registered for some client in the realm and relies on user interaction to click a crafted link. The vulnerability also affects the /oauth2/connect/checkSession endpoint with similar token verification gaps; both are fixed in 16.1.3 by adding proper signature and client verification.

Affected products

  • OpenIdentityPlatform OpenAM before 16.1.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.