CVE-2026-123547Medium· 4.7▾ SunlitOpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrlList is configured. Attackers can craft single sign-on links with…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 25.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrlList is configured. Attackers can craft single sign-on links with a malicious RelayState to send users from the trusted OpenAM origin to phishing sites and bypass URL filters.
OpenAM < 16.1.4OpenAM < 16.1.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123541Medium· 4.7OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching
CVE-2026-123548Medium· 4.7OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages
CVE-2026-123537Medium· 5.0OpenAM before 16.1.4 SSRF via UMA Scope Description URLs
CVE-2026-123536Medium· 4.1OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs
CVE-2026-123538Medium· 6.6OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation
CVE-2026-123539Medium· 4.8OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display Name