CVE-2026-121825
Open redirect in the Liberty ID-FF service provider single sign-on flow
OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier contains an open redirect vulnerability (CWE-601) in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without validation, and after the user completes single sign-on at the identity provider, the assertion consumer service redirects the browser to that value. A remote unauthenticated attacker can induce a user to access a crafted URL and, after the user authenticates, redirect the user to an arbitrary website, which may be used for phishing. Only deployments in which a Liberty ID-FF hosted service provider is configured are affected; Liberty ID-FF is not configured by default. This issue is fixed in 14.0.6, which disables the legacy Liberty ID-FF endpoints.
Fixes and workarounds
Fix
Upgrade to OpenAM (OpenAM Consortium Edition) 14.0.6 or later. Note that 14.0.6 disables the legacy Liberty ID-FF endpoints.
Source: CNA: openam-jpWorkaround
If Liberty ID-FF is not used, remove the Liberty ID-FF servlet mappings (including /preLogin, /IntersiteTransferService and /AssertionConsumerService/*) from WEB-INF/web.xml, or block access to these endpoints at a reverse proxy or web application firewall.
Source: CNA: openam-jpAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| OpenAM (OpenAM Consortium Edition) OpenAM consortium https://github.com/openam-jp/openam |
≥ 14.0.0; < 14.0.6 (affected, semver)
Other versions: unaffected |
CNA: openam-jp |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 5.1 medium |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | CNA: openam-jp |
| 3.1 / 6.1 medium |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | CNA: openam-jp |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://openam-jp.github.io/Advisories/CVE-2026-121825/CNA: openam-jp · vendor-advisory
- https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8CNA: openam-jp · related
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.