Dashboard / CVE-2026-123546

CVE-2026-123546

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 61/100
Published: 2026-11-08 Modified: 2026-11-10 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Passive
S: X
AT: None
VC: Low
VI: Low
VA: None

Description

OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run script in the XUI to steal session cookies.

Weakness Classification (1)

Affected Software (8)

VendorProductVersion
OpenIdentityPlatform OpenAM 0 < 16.1.4
OpenIdentityPlatform OpenAM 0 < 16.1.4
OpenIdentityPlatform OpenAM 0 < 16.1.4
OpenIdentityPlatform OpenAM 0 < 16.1.4
OpenIdentityPlatform OpenAM 0 < 16.1.4
OpenIdentityPlatform OpenAM 0 < 16.1.4
OpenIdentityPlatform OpenAM 0 < 16.1.4
OpenIdentityPlatform OpenAM 0 < 16.1.4

References & Advisories (2)

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

5.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.22%
Raw Score 0.002240
Percentile 13.2%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00224
2026-11-12
0.00224
2026-11-10
0.00224
2026-11-09
0.00224
2026-11-08
0.00224

Intelligence Sources

mitre ref →
nvd ref →

External Links