OpenAM CVE-2026-121825

Two concrete prerequisites apply. (1) A Liberty ID-FF hosted service provider must be configured on the OpenAM Consortium Edition deployment - this legacy federation feature is NOT configured by default, so default installations are not affected. (2) The attacker cannot complete the attack alone: per the CVSS UI:A metric, a victim must be induced to open the attacker-crafted /preLogin URL AND then successfully complete single sign-on at the identity provider before the unvalidated goto/RelayState redirect fires. Limiting factors that reduce realistic risk: the non-default ID-FF configuration requirement, the mandatory user interaction plus successful authentication, and the impact being confined to a browser redirect for phishing (no direct compromise of OpenAM, its data, or availability). The complete fix is upgrading to 14.0.6, which disables the legacy ID-FF endpoints.

Signals point to a genuine but modest risk. The CVSS 4.0 base score is 5.1 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:A: a remote, unauthenticated attacker can reach the flaw, but exploitation hinges on victim interaction (UI:A) - the user must open a crafted link and then successfully complete single sign-on. Impact is confined to the subsequent system (SC:L/SI:L) with no confidentiality, integrity or availability impact to OpenAM itself (VC:N/VI:N/VA:N), consistent with an open redirect used for phishing rather than system compromise. No EPSS score was supplied and the input shows no CISA KEV listing, so there is no evidence of active exploitation; the reporter (openam-jp) states proof-of-concept code is deliberately withheld, so no working exploit is public. The vuln.today decision label is 'this_month' (not act_now/emergency), matching a patch-in-normal-cycle posture. A key limiting factor is that only deployments with a Liberty ID-FF hosted service provider configured are affected, and ID-FF is not enabled by default. IMPORTANT CROSS-SOURCE CONFLICT: the attached GitHub advisory (GHSA-5c3q-hp86-xjr8) is for a DIFFERENT fork - OpenIdentityPlatform OpenAM, fixed in 16.1.4 - and describes a far more severe, higher-impact issue (unauthenticated live session-token disclosure via the notification WebSocket enabling session hijacking). That is not the vulnerability scored here (5.1 / open redirect in OpenAM Consortium Edition, fixed in 14.0.6); the two share the legacy ID-FF endpoints but are distinct advisories for distinct products. Operators running OpenIdentityPlatform OpenAM should assess that session-hijacking issue separately as a materially higher priority - verify which product you run before triaging.

An attacker crafts a URL to the OpenAM /preLogin endpoint whose goto parameter points at an attacker-controlled site, then lures a user to open it. After the user authenticates at the identity provider, the assertion consumer service redirects the browser to the unvalidated goto value, landing the victim on a convincing phishing page that appears to follow a trusted login. No public working exploit is available - the reporter withheld proof-of-concept code.