Is CVE-2026-123541 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123541 being exploited in the wild.

How severe is CVE-2026-123541?

Medium severity, with a CVSS score of 4.7, published 8 November 2026.

Which products and versions are affected?

Open Identity Platform OpenAM before 16.1.4.

How is CVE-2026-123541 attacked?

It is attacked over the network.

Am I affected by CVE-2026-123541?

Check whether you run Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123541: OpenAM open redirect in SAML 1.x single sign-on

CVE-2026-123541 · Severity: medium · CVSS 4.7 · Published 2026-11-08

OpenAM is a single sign-on platform that manages authentication for enterprise applications via the SAML protocol. An open redirect vulnerability in SAML 1.x allows attackers to craft login links that, after a user authenticates, redirect them to a phishing site instead of a legitimate application. While users must click the initial link and the attacker cannot access authentication tokens, the attack leverages the trusted OpenAM domain to deceive users.

Technologies: Open Identity Platform OpenAM. Vendors: Open Identity Platform.

Quick answers

Is CVE-2026-123541 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123541 being exploited in the wild.
How severe is CVE-2026-123541?: Medium severity, with a CVSS score of 4.7, published 8 November 2026.
Which products and versions are affected?: Open Identity Platform OpenAM before 16.1.4.
Is there a fix for CVE-2026-123541?: Yes: fixed in OpenAM 16.1.4. Until then: Block SAML 1.x profile endpoints (/SAMLAwareServlet and /SAMLPOSTProfileServlet) at the reverse proxy if SAML 1.x is not in use. Restrict where users may be sent after single sign-on on partner service providers, and inform users that links starting with the OpenAM address may redirect elsewhere. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123541 attacked?: It is attacked over the network.
Am I affected by CVE-2026-123541?: Check whether you run Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: OpenAM 16.1.4

Block SAML 1.x profile endpoints (/SAMLAwareServlet and /SAMLPOSTProfileServlet) at the reverse proxy if SAML 1.x is not in use. Restrict where users may be sent after single sign-on on partner service providers, and inform users that links starting with the OpenAM address may redirect elsewhere.

Technical details

The vulnerability stems from improper validation of the destination parameter in SAML 1.x Intersite Transfer and POST profile endpoints (/SAMLAwareServlet and /SAMLPOSTProfileServlet). An attacker can specify a destination host that resembles a trusted partner's hostname (insufficient matching strictness) to cause authenticated users to be redirected to attacker-controlled sites. SAML v2.0, WS-Federation, and OAuth 2.0/OpenID Connect are unaffected; only SAML 1.x identity provider deployments with configured trusted partners are vulnerable.

Affected products

Open Identity Platform OpenAM before 16.1.4

Timeline

2026-10-22: disclosed
2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.