CVE-2026-81029: URL Redirection to Untrusted Site ('Open Redirect') in open-metadata OpenMetadata

OpenMetadata's SamlLoginServlet and OIDC/OAuth2 handlers accept a caller-supplied redirect target after authentication and append a freshly issued token along with user details to this URL. The redirect target is stored and used without validation against any configured or registered destinations. An attacker can exploit this by providing a redirect URL they control, causing the server to send a valid JWT token to the attacker-controlled site after user login. This token authenticates API calls as the logged-in user, effectively allowing account takeover. The vulnerability affects all versions prior to 2.0.0, which removes the vulnerable callback parameter.

Successful exploitation results in an attacker gaining control over a user's account by obtaining a valid authentication token issued during login. This enables unauthorized API access as the compromised user. The vulnerability is rated high severity with a CVSS 4.0 score of 8.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality and integrity.

Version 2.0.0 of OpenMetadata removes the caller-supplied callback parameter, eliminating this vulnerability. Users should upgrade to version 2.0.0 or later. No official patch or temporary fix is documented for versions prior to 2.0.0. Until upgraded, avoid using untrusted redirect URLs and monitor for suspicious login redirects.