Executive brief
OpenMetadata is an open-source data governance platform that authenticates users via SAML, OIDC, and OAuth2. The application accepts a caller-supplied redirect destination after login and appends the newly issued authentication token to the redirect URL, allowing an attacker to steal valid session tokens by tricking users into clicking malicious links that redirect to attacker-controlled servers. Once captured, these tokens grant full account access to the victim's data and permissions within OpenMetadata.
Technical details
The vulnerability is an open redirect combined with token leakage that affects the SAML, OIDC, and OAuth2 authentication handlers in OpenMetadata versions prior to 2.0.0. The SamlLoginServlet reads an attacker-controlled callback parameter from the HTTP request, stores it in the session without validating it against any allowlist, and the assertion consumer servlet later constructs a redirect URL containing the freshly issued JWT token, user email, and user name, directing the browser to the attacker's destination. The same flaw exists in the OIDC and OAuth2 handlers with their own redirect parameters. Attack preconditions are minimal—no authentication is required from the attacker, only social engineering to cause a victim to visit a malicious link. An attacker can capture valid JWT tokens and use them to impersonate users and access the API. Version 2.0.0 removes the caller-supplied callback parameter entirely; no 1.x release contains a fix.
Affected products
- OpenMetadata OpenMetadata versions prior to 2.0.0
Timeline
- 2026-08-26: disclosed
- 2026: patched: Fixed in version 2.0.0