OpenAM CVE-2026-105118

Exploitation targets the OpenID Connect RP-initiated logout endpoint /oauth2/connect/endSession, which accepts the id_token_hint JWT WITHOUT verifying its signature (CWE-347). The concrete prerequisites are: (1) the attacker forges an id_token_hint that references an existing realm OAuth2/OIDC client, and (2) the redirect destination must be a post_logout_redirect_uri already REGISTERED with that client - the attacker cannot redirect to an arbitrary unregistered URL, so a client with an attacker-influenced or overly permissive registered post-logout URI must exist. Limiting factors that reduce real-world risk: the attack is unauthenticated (PR:N) but requires victim user interaction to click the crafted link (UI:P), carries high attack complexity and a present attack requirement (AC:H/AT:P), and affects only deployments running OpenAM before 16.1.3.

This is a genuinely low-priority issue, and the signals are internally consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N) yields a base score of only 2.3 - network-reachable and unauthenticated (PR:N), but gated by high attack complexity (AC:H), a present attack requirement (AT:P), required user interaction (UI:P), and only low impact to confidentiality/integrity with no availability impact. The CWE-347 (improper signature verification) root cause is real - the id_token_hint JWT is accepted without verification - but the resulting primitive is an open redirect, not code execution or data theft. No EPSS score was provided; it is not in CISA KEV ('no public exploit identified at time of analysis'); and no POC is referenced. There is no conflict between the signals: a low CVSS, no KEV listing, and no POC all point the same direction. The practical value to an attacker is limited to lending the trusted OpenAM host's reputation to a phishing redirect, and the redirect target is constrained to URIs already registered with a realm client, which further caps impact. Treat as routine patch-cycle remediation, not emergency.

An attacker crafts a phishing link to OpenAM's /oauth2/connect/endSession endpoint carrying a forged, unverified id_token_hint that names a realm client whose registered post-logout redirect URI is attacker-influenced. A victim who clicks the link is logged out and silently redirected from the trusted OpenAM host to the attacker's page, which harvests credentials under the borrowed trust of the legitimate domain. No public exploit code is identified, and success requires the victim to click (UI:P) and a suitably registered post-logout URI (AC:H/AT:P).