MEDIUM 5.3 NVD
CVE-2026-123546
OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations
OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run script in the XUI to steal session cookies.
References
- https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2gwf-vxp5-f9v2
- https://www.vulncheck.com/advisories/openam-before-16.1.4-open-redirect-and-xss-via-goto-a
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.