CVE-2026-123548 OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123548?
CVE-2026-123548 is a low-severity vulnerability in OpenIdentityPlatform OpenAM, published on 8 Nov 2026.
Official description
OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed lists. Attackers can craft OpenAM-domain links that send users to arbitrary external sites for phishing.
Weakness: CWE-601
Which versions are affected by CVE-2026-123548?
How do I fix CVE-2026-123548?
No fix has been published for CVE-2026-123548 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123548 being exploited?
There is no known exploitation of CVE-2026-123548 in the wild and no public exploit code.
Sources
Also known as GHSA-92v8-9887-h97x, GHSA-mgwg-24cx-c8w3.