CVE-2026-123541

OpenAM versions prior to 16.1.4 are vulnerable to an open redirect flaw during SAML 1.x single sign-on. The root cause is loose trusted-partner destination matching , which allows remote attackers to craft links to /SAMLAwareServlet or /SAMLPOSTProfileServlet . By using a destination host that re...

CVE-2026-123541 OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching

OpenAM before 16.1.4 contains an open redirect vulnerability that allows remote attackers to redirect users after SAML 1.x single sign-on by exploiting loose trusted-partner destination matching. Attackers can craft links to /SAMLAwareServlet or /SAMLPOSTProfileServlet with a destination host...

PT-2026-139822

OpenAM before 16.1.4 contains an open redirect vulnerability that allows remote attackers to redirect users after SAML 1.x single sign-on by exploiting loose trusted-partner destination matching. Attackers can craft links to /SAMLAwareServlet or /SAMLPOSTProfileServlet with a destination host...