CVE-2026-123547

4.7 MEDIUMpublic exploit available

Published 2026-11-08 · Updated 2026-11-10

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrlList is configured. Attackers can craft single sign-on links with a malicious RelayState to send users from the trusted OpenAM origin to phishing sites and bypass URL filters.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-601

Public exploit & PoC references

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-fhqm-62hv-4phw

All references

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-fhqm-62hv-4phw
https://www.vulncheck.com/advisories/openam-before-16.1.4-open-redirect-via-saml-2.0-relaystate

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2024-12141
MEDIUMCVE-2024-2372
MEDIUMCVE-2024-4989PoC
MEDIUMCVE-2024-58389PoC
MEDIUMCVE-2024-58398PoC
MEDIUMCVE-2026-100523PoC
CRITICALCVE-2026-101090PoC
MEDIUMCVE-2026-101151

Related by shared AI tags and CWE weakness class. Browse the full archive.