CVE-2026-105118: Improper Verification of Cryptographic Signature in OpenIdentityPlatform OpenAM
OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered post-logout URI, enabling phishing that borrows the OpenAM host's trust.
AI Analysis
Technical Summary
CVE-2026-105118 describes an open redirect vulnerability in OpenIdentityPlatform's OpenAM product prior to version 16.1.3. The vulnerability arises from improper verification of the cryptographic signature on the id_token_hint parameter at the /oauth2/connect/endSession endpoint. Attackers can craft an unverified id_token_hint that names any realm client, enabling redirection of users to any registered post-logout URI associated with that client. This behavior can be exploited to conduct phishing attacks that exploit the trust relationship users have with the OpenAM host.
Potential Impact
The vulnerability allows unauthenticated attackers to redirect users to arbitrary post-logout URIs by supplying a forged id_token_hint. This can be used to facilitate phishing attacks that appear to originate from the trusted OpenAM host. The CVSS 4.0 score is low (2.3), reflecting the requirement for user interaction and the complexity of exploitation. There is no indication of direct compromise or privilege escalation from this vulnerability.
Mitigation Recommendations
A fix is available in OpenAM version 16.1.3. Users should upgrade to version 16.1.3 or later to remediate this vulnerability. No other mitigations are indicated in the provided data.
CVE-2026-105118: Improper Verification of Cryptographic Signature in OpenIdentityPlatform OpenAM
Description
OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered post-logout URI, enabling phishing that borrows the OpenAM host's trust.
CVSS v4.0
Score 2.3low
Affected software
OpenIdentityPlatform
OpenAM
pkg:github/openidentityplatform/OpenAMRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-105118 describes an open redirect vulnerability in OpenIdentityPlatform's OpenAM product prior to version 16.1.3. The vulnerability arises from improper verification of the cryptographic signature on the id_token_hint parameter at the /oauth2/connect/endSession endpoint. Attackers can craft an unverified id_token_hint that names any realm client, enabling redirection of users to any registered post-logout URI associated with that client. This behavior can be exploited to conduct phishing attacks that exploit the trust relationship users have with the OpenAM host.
Potential Impact
The vulnerability allows unauthenticated attackers to redirect users to arbitrary post-logout URIs by supplying a forged id_token_hint. This can be used to facilitate phishing attacks that appear to originate from the trusted OpenAM host. The CVSS 4.0 score is low (2.3), reflecting the requirement for user interaction and the complexity of exploitation. There is no indication of direct compromise or privilege escalation from this vulnerability.
Mitigation Recommendations
A fix is available in OpenAM version 16.1.3. Users should upgrade to version 16.1.3 or later to remediate this vulnerability. No other mitigations are indicated in the provided data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-03T12:04:36.964Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac10acea43b0b3b89c6cf68
Added to database: 10/03/2026, 14:01:50 UTC
Last enriched: 10/03/2026, 14:16:24 UTC
Last updated: 10/03/2026, 14:54:14 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.