A new vulnerability in the OpenAM identity platform could let an attacker redirect users to a malicious website after they sign in. The flaw, tracked as CVE-2026-121825, was published on 9 November 2026 and affects OpenAM 14.0.5 and earlier. It is rated medium severity.

OpenAM is an open-source access management and single sign-on system used by organisations to control who can reach their applications. The flaw sits in its Liberty ID-FF service provider single sign-on flow, a legacy federation feature. Because the feature is not switched on by default, only deployments that have configured a Liberty ID-FF hosted service provider are affected.

How the flaw works

The problem is an open redirect, classed as CWE-601. When a user starts signing in, the goto parameter of OpenAM's /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without being checked. After the user completes sign-on at the identity provider, the assertion consumer service redirects the browser to that stored value.

A remote attacker who has not logged in can therefore craft a link that, once the victim has authenticated, sends the victim's browser to an arbitrary website. The most obvious abuse is phishing: a victim who has just signed in through a trusted-looking link could land on a fake page designed to steal credentials or spread malware. The attacker does not need an account on the target system, but does need the victim to click the crafted link.

Who is affected and what to do

Only deployments with a Liberty ID-FF hosted service provider configured are at risk. OpenAM deployments that have never enabled that legacy feature are not affected.

The CVE record states that the issue is fixed in OpenAM 14.0.6, which disables the legacy Liberty ID-FF endpoints. Operators should upgrade to 14.0.6 or later. As a shorter-term step, deployments that do not use Liberty ID-FF federation can block or disable the legacy endpoints, and redirect parameters should be validated rather than passed through unchecked.

The same legacy ID-FF endpoints were also at the centre of a separate, more severe OpenAM disclosure, CVE-2026-123551, in which unauthenticated attackers could read live session tokens. That flaw is fixed in OpenAM 16.1.4. The two disclosures underline the same lesson: legacy federation endpoints that are no longer widely used can still carry serious risk if they remain reachable.

What is not yet known

No public proof-of-concept exploit for CVE-2026-121825 has been published, and there is no confirmed report of the flaw being exploited in the wild. The CVE record rates it medium severity under both CVSS 3.1 and CVSS 4.0, reflecting that user interaction is needed and that the direct impact is a redirect rather than data theft on its own. Organisations running affected OpenAM versions should still treat the upgrade as a priority, because open redirects are a standard building block in phishing campaigns.