---
id: CVE-2026-123546
title: OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFail
summary: >-
  OpenAM before 16.1.4 contains an open redirect and cross-site scripting
  vulnerability that allows remote attackers to control post-login and logout
  destinations via the goto and gotoOnFail parameters. Attackers can craft
  OpenAM login or …
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: OpenIdentityPlatform
product: OpenAM
affected:
  - OpenAM < 16.1.4
  - OpenAM < 16.1.4
  - OpenAM < 16.1.4
  - OpenAM < 16.1.4
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:37:51.373Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123546'
references:
  - url: >-
      https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2gwf-vxp5-f9v2
    label: GitHub Security Advisory (GHSA-2gwf-vxp5-f9v2)
  - url: >-
      https://www.vulncheck.com/advisories/openam-before-16.1.4-open-redirect-and-xss-via-goto-and-gotoonfail
    label: >-
      VulnCheck Advisory: OpenAM before 16.1.4 Open Redirect and XSS via goto
      and gotoOnFail
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.674Z'
---

## Overview

OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run script in the XUI to steal session cookies.

## Affected

- `OpenAM < 16.1.4`
- `OpenAM < 16.1.4`
- `OpenAM < 16.1.4`
- `OpenAM < 16.1.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.