Threats affecting pkg:github/OpenAM (OpenAM Consortium Edition)

OpenAM Consortium Edition versions 14.0.5 and earlier contain an open redirect vulnerability in the Liberty ID-FF service provider single sign-on flow. The vulnerability arises because the 'goto' parameter is used without validation to redirect users after authentication, potentially allowing attackers to redirect users to arbitrary websites. This affects deployments where Liberty ID-FF hosted service provider is configured, which is not enabled by default. The issue is fixed in version 14.0.6 by disabling the legacy Liberty ID-FF endpoints.