Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.3
CVE-2026-105118: OpenAM before 16.1.3 can send users to malicious sites after logout
CVE-2026-105118 · published 15 days ago
Summary
The OpenAM login system (versions older than 16.1.3) can be tricked into sending users to any website after they log out. An attacker could craft a logout request that redirects a user to a phishing page, using the trust people have in the OpenAM domain. Updating OpenAM to version 16.1.3 or later removes this risk.
Original advisory text
OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession
OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered post-logout URI, enabling phishing that borrows the OpenAM host's trust.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-1051... Vendor Advisory
- https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-6f8c-crw...
- https://nvd.nist.gov/vuln/detail/CVE-2026-105118 Vendor Advisory
- https://www.vulncheck.com/advisories/openam-before-16.1.3-open-redirect-via-unve...
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published3 Oct 2026
Updated9 Oct 2026
First seen3 Oct 2026
Track software like this
Free during beta