CVE-2026-121825

OpenAM OpenAM Consortium Edition 14.0.5 and earlier contains an open redirect vulnerability CWE-601 in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without validation, a...