CVE WATCH / VULNERABILITY DETAIL
CVE-2026-123541
MEDIUMCVSS 4.7NVD feed
Published 8 November 2026 · tracked since 8 November 2026
Description
OpenAM before 16.1.4 contains an open redirect vulnerability that allows remote attackers to redirect users after SAML 1.x single sign-on by exploiting loose trusted-partner destination matching. Attackers can craft links to /SAMLAwareServlet or /SAMLPOSTProfileServlet with a destination host resemb
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog