OpenAM consortium up to 14.0.5 Liberty ID-FF goto redirect

Summaryinfo

A vulnerability marked as problematic has been reported in OpenAM consortium OpenAM up to 14.0.5. This affects an unknown part of the component Liberty ID-FF. Performing a manipulation of the argument goto results in redirect. This vulnerability is reported as CVE-2026-121825. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in OpenAM consortium OpenAM up to 14.0.5. This affects an unknown code of the component Liberty ID-FF. The manipulation of the argument goto with an unknown input leads to a redirect vulnerability. CWE is classifying the issue as CWE-601. The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. This is going to have an impact on integrity. The summary by CVE is:

OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier contains an open redirect vulnerability (CWE-601) in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without validation, and after the user completes single sign-on at the identity provider, the assertion consumer service redirects the browser to that value. A remote unauthenticated attacker can induce a user to access a crafted URL and, after the user authenticates, redirect the user to an arbitrary website, which may be used for phishing. Only deployments in which a Liberty ID-FF hosted service provider is configured are affected; Liberty ID-FF is not configured by default. This issue is fixed in 14.0.6, which disables the legacy Liberty ID-FF endpoints.

The advisory is shared at openam-jp.github.io. This vulnerability is uniquely identified as CVE-2026-121825 since 11/04/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

Upgrading to version 14.0.6 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• OpenAM consortium

Name

• OpenAM

Version

• 14.0.0
• 14.0.1
• 14.0.2
• 14.0.3
• 14.0.4
• 14.0.5

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion