OpenAM EUVD-2026-92020

Requires the non-default cookieHashRedirectEnabled load-balancer cookie setting to be active, making the SAML cookie bounce auto-submit page reachable; the attacker must supply a crafted SAML message, relay state, or target URL whose unencoded content reaches that page. Exploitation further requires active victim interaction (CVSS UI:A) to load the attacker-influenced page in their browser. A critical LIMITING factor is that released versions before 16.1.3 abort with an unrelated HTTP 500 error that prevents the payload from executing, so default released builds are not practically exploitable; impact, when triggered, is limited to the browser/OpenAM origin (client-side script), not server compromise.

This is a medium-severity (CVSS 4.0 base 5.1) reflected cross-site scripting issue in OpenAM's SAML load-balancer cookie bounce auto-submit page (CWE-79), reported by VulnCheck. The provided CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:A) indicates a network-reachable flaw with no privileges but requiring active user interaction, and the impact is confined to subsequent-system confidentiality/integrity (SC:L/SI:L) with no vulnerable-system impact (VC/VI/VA:N) - consistent with script execution in the OpenAM browser origin rather than server compromise. The single most important mitigating signal is in the description itself: this is a LATENT defect - an unrelated HTTP 500 failure prevents exploitation in released versions, and it is only reachable when the non-default cookieHashRedirectEnabled setting is used. No EPSS score was provided, so exploitation probability cannot be quantified; there is no CISA KEV listing and no public exploit referenced, so there is no public exploit identified at time of analysis. Net assessment: despite a network/unauthenticated CVSS vector, real-world risk is LOW - exploitation is blocked in shipped builds, gated behind a non-default configuration, and requires victim interaction. One conflict worth noting: the input CVSS uses AC:L, but the dependence on a non-default config plus a blocking 500 error argues for higher attack complexity than AC:L implies.

In a deployment with cookieHashRedirectEnabled, an attacker crafts a SAML request whose message, relay state, or target URL carries unencoded markup, then lures an authenticated user's browser to the load-balancer cookie bounce auto-submit page, where the payload would render and execute script in the OpenAM origin (e.g., to steal session context). No public exploit code is identified, and in released versions an unrelated HTTP 500 error reportedly aborts the flow, so a working attack would require a build or configuration where that failure does not occur.