CVE-2026-105118 in OpenAM
Summary
by MITRE • 10/03/2026
OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered post-logout URI, enabling phishing that borrows the OpenAM host's trust.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified within versions of ForgeRock Access Manager prior to 16.1.3 represents a critical authentication bypass and open redirect flaw located in the OAuth2 end session endpoint. This specific weakness allows unauthenticated actors to manipulate the logout flow by injecting malicious parameters into the id_token_hint field. The core technical failure lies in the insufficient validation of this hint, which permits attackers to specify arbitrary realm clients that are not legitimately associated with the current user context or intended logout operation. By exploiting this lack of strict verification, an attacker can force the application to redirect the victim's browser to a pre-registered post-logout URI controlled by the adversary rather than performing a secure session termination and returning the user to a trusted location.
From an operational perspective, this vulnerability facilitates sophisticated phishing campaigns that leverage the inherent trust users place in the OpenAM host domain. When a victim is redirected through the legitimate authentication server infrastructure to a malicious site, they are likely to perceive the destination as trustworthy because it appears within the context of their existing session or login flow. This technique effectively bypasses user skepticism regarding suspicious links, as the URL originates from a recognized identity provider. The attacker can then host credential harvesting pages or malware distribution sites that mimic legitimate services, significantly increasing the success rate of social engineering attacks compared to standard phishing attempts originating from external domains.
This flaw aligns with CWE-601, which defines Open Redirect vulnerabilities where an application redirects users to URLs provided by user input without proper validation. Furthermore, in the context of the MITRE ATT&CK framework, this behavior corresponds to Tactic TA0001 Initial Access and Technique T1566 Phishing, specifically leveraging trusted infrastructure to deceive victims. The exploitation does not require prior authentication, making it particularly dangerous as it can be triggered by any user visiting a crafted link or being redirected via cross-site scripting if the parameter is injectable through other vectors.
To mitigate this risk, organizations must upgrade immediately to version 16.1.3 or later of OpenAM, where these validation checks have been hardened. Administrators should also review their OAuth2 client configurations to ensure that post-logout redirect URIs are strictly whitelisted and cannot be manipulated through token hints. Implementing additional security headers such as Content Security Policy can help mitigate the impact by restricting navigation targets, although patching remains the primary defense against this specific implementation flaw in the session management logic.