CVE-2026-105118

4.7 MEDIUMpublic exploit available

Published 2026-10-03 · Updated 2026-10-06

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered post-logout URI, enabling phishing that borrows the OpenAM host's trust.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-347

Public exploit & PoC references

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-6f8c-crwq-jqm3

All references

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-6f8c-crwq-jqm3
https://www.vulncheck.com/advisories/openam-before-16.1.3-open-redirect-via-unverified-id-token-hint-in-endsession

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-71422PoC
HIGHCVE-2026-100293
HIGHCVE-2026-102266PoC
CRITICALCVE-2026-102268PoC
HIGHCVE-2026-102271PoC
HIGHCVE-2026-102272PoC
HIGHCVE-2026-102273PoC
MEDIUMCVE-2026-102502

Related by shared AI tags and CWE weakness class. Browse the full archive.