CVE-2026-123548: OpenIdentityPlatform OpenAM open redirect in WS-Federation and SAML pages

CVE-2026-123548 · Severity: medium · CVSS 4.7 · Published 2026-11-08

OpenAM is an identity and access management platform that handles authentication and authorization for enterprise applications. The product fails to validate redirect destination URLs in several logout and authentication flows, allowing attackers to craft malicious links that appear to come from the trusted OpenAM domain but redirect users to external phishing sites. An attacker must trick a user into clicking a specially crafted link; no data is accessed or modified on the OpenAM server itself.

Technologies: OpenIdentityPlatform OpenAM. Vendors: OpenIdentityPlatform.

Quick answers

Is CVE-2026-123548 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-123548 being exploited in the wild.
How severe is CVE-2026-123548?
Medium severity, with a CVSS score of 4.7, published 8 November 2026.
Which products and versions are affected?
OpenIdentityPlatform OpenAM before 16.1.4.
Is there a fix for CVE-2026-123548?
Yes: fixed in 16.1.4. Until then: Until upgrading to 16.1.4, operators should block WS-Federation and SAML v2.0 logout pages at the reverse proxy if those federation protocols are not in use, configure destination allow-lists for all hosted entities (RelayState URL lists for SAML v2.0, wreply lists for WS-Federation, and Valid goto URL Resources per realm), and avoid deploying ESAPI validation.properties with URL validation rules to OpenAM's classpath. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123548 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-123548?
Check whether you run OpenIdentityPlatform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 16.1.4

Until upgrading to 16.1.4, operators should block WS-Federation and SAML v2.0 logout pages at the reverse proxy if those federation protocols are not in use, configure destination allow-lists for all hosted entities (RelayState URL lists for SAML v2.0, wreply lists for WS-Federation, and Valid goto URL Resources per realm), and avoid deploying ESAPI validation.properties with URL validation rules to OpenAM's classpath.

Technical details

Multiple OpenAM components—WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages—accept user-supplied destination URLs without reliably validating them against configured allowed lists (CWE-601). The vulnerability requires user interaction (clicking a link) and is reachable via the network. On default installations, most redirects are blocked by a validation layer; however, the identity provider proxying flow bypasses this layer entirely. Patch 16.1.4 adds validation checks and restricts unvalidated redirects to the deployment's own origin.

Affected products

  • OpenIdentityPlatform OpenAM before 16.1.4

Timeline

  • 2026-10-22: disclosed
  • 2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.