What is GHSA-mxvw-rw3m-5c33?

GHSA-mxvw-rw3m-5c33 is a security advisory published by GitHub Security Advisories with Low severity. OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated...

Which CVE IDs does GHSA-mxvw-rw3m-5c33 cover?

GHSA-mxvw-rw3m-5c33 covers the following CVE IDs: CVE-2026-105118. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mxvw-rw3m-5c33?

GHSA-mxvw-rw3m-5c33 has a CVSS v3 base score of 4.7, published by GitHub Security Advisories.

GHSA-mxvw-rw3m-5c33LowCVSS 4.7

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated...

Vendor

GitHub Security Advisories

Published

October 3, 2026

Last Modified

October 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-105118 →

📋 Description

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered post-logout URI, enabling phishing that borrows the OpenAM host's trust.

🔗 References (4)

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-6f8c-crwq-jqm3
https://nvd.nist.gov/vuln/detail/CVE-2026-105118
https://www.vulncheck.com/advisories/openam-before-16.1.3-open-redirect-via-unverified-id-token-hint-in-endsession
https://github.com/advisories/GHSA-mxvw-rw3m-5c33