CVE-2026-121825

Published: November 9, 2026 / Updated: November 9, 2026
Severity Rating: Medium
CVSS Score: 5.1 (CVSS v4.0)
Affected Products: OpenAM 14.0.5 or earlier

Description

OpenAM (OpenAM Consortium Edition) contains an open redirect vulnerability in the Liberty ID-FF service provider single sign-on flow.

The goto parameter of the /preLogin endpoint is used as the redirect destination after single sign-on without validation.

Only deployments in which a Liberty ID-FF hosted service provider is configured are affected. Liberty ID-FF is not configured by default.

Impact

When a user accesses a specially crafted URL and completes single sign-on at the identity provider, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack.

Solution

The OpenAM Consortium has released OpenAM 14.0.6, which addresses the vulnerability. Please update to the released OpenAM version.

Note that OpenAM 14.0.6 disables the legacy Liberty ID-FF endpoints.

Workaround

If Liberty ID-FF is not used, remove the Liberty ID-FF servlet mappings (including /preLogin, /IntersiteTransferService and /AssertionConsumerService/*) from WEB-INF/web.xml, or block access to these endpoints at a reverse proxy or web application firewall.

Reference

https://www.cve.org/CVERecord?id=CVE-2026-121825
https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8 (Liberty ID-FF RelayState open redirect fixed in OpenIdentityPlatform OpenAM 16.1.4)

Credit

Reported by Arittro Sarkar.