What is GHSA-92v8-9887-h97x?

GHSA-92v8-9887-h97x is a security advisory published by GitHub Security Advisories with Low severity. OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout,...

Which CVE IDs does GHSA-92v8-9887-h97x cover?

GHSA-92v8-9887-h97x covers the following CVE IDs: CVE-2026-123548. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-92v8-9887-h97x?

GHSA-92v8-9887-h97x has a CVSS v3 base score of 4.7, published by GitHub Security Advisories.

GHSA-92v8-9887-h97xLowCVSS 4.7

OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout,...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-123548 →

📋 Description

OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed lists. Attackers can craft OpenAM-domain links that send users to arbitrary external sites for phishing.

🔗 References (4)

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-mgwg-24cx-c8w3
https://nvd.nist.gov/vuln/detail/CVE-2026-123548
https://www.vulncheck.com/advisories/openam-before-16.1.4-open-redirect-via-ws-federation-and-saml-2.0-pages
https://github.com/advisories/GHSA-92v8-9887-h97x