OpenAM Consortium 14.0.6 Fixes Liberty ID-FF Open Redirect
Tech GuruQuick Answer
Check OpenAM Consortium Edition 14.0.5 or earlier for hosted Liberty ID-FF service-provider use. Upgrade to 14.0.6 after planning for disabled legacy endpoints, validate supported sign-in workflows, and retain configuration and version evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Record the OpenAM edition and version, hosted Liberty ID-FF providers, application owners, reverse-proxy routes and legacy federation dependencies. The authority limits this issue to deployments with a hosted Liberty ID-FF service provider; this feature is not enabled by default. Distinguish Consortium Edition from OpenIdentityPlatform OpenAM. Upgrade to OpenAM Consortium Edition 14.0.6. If Liberty ID-FF is unused, the authority permits removing its servlet mappings from WEB-INF/web.xml or blocking those endpoints at a reverse proxy or WAF. Verify the installed edition/version and endpoint exposure, test supported authentication and redirect destinations, and retain federation configuration and change-test evidence.
Last verified: 2026-11-09 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | OpenAM Consortium Edition with a hosted Liberty ID-FF service provider |
|---|---|
| Advisory | CVE-2026-121825 |
| CVE | CVE-2026-121825 |
| Authoritative release date | November 9, 2026; the authority provides a calendar date without a release time. |
| Authority revision date | Updated November 9, 2026; no separate time or later material revision is stated. |
| Affected versions | OpenAM Consortium Edition 14.0.5 or earlier when a Liberty ID-FF hosted service provider is configured. The authority says Liberty ID-FF is not configured by default. |
| Fixed version | OpenAM Consortium Edition 14.0.6 |
| CVSS base score | 5.1 (CVSS v4.0) |
| CVSS severity | Medium |
| Exploitation status | The OpenAM Consortium does not state malicious exploitation.; no exploitation claim is inferred. |
What Changed
The OpenAM Consortium fixed an open redirect in the Liberty ID-FF service-provider single-sign-on flow. An unvalidated goto value can redirect a user to an attacker-selected site after authentication. Version 14.0.6 addresses the issue by disabling legacy Liberty ID-FF endpoints.
What To Validate Now
- Inventory. Record the OpenAM edition and version, hosted Liberty ID-FF providers, application owners, reverse-proxy routes and legacy federation dependencies.
- Establish applicability. The authority limits this issue to deployments with a hosted Liberty ID-FF service provider; this feature is not enabled by default. Distinguish Consortium Edition from OpenIdentityPlatform OpenAM.
- Remediate. Upgrade to OpenAM Consortium Edition 14.0.6. If Liberty ID-FF is unused, the authority permits removing its servlet mappings from WEB-INF/web.xml or blocking those endpoints at a reverse proxy or WAF.
- Validate. Verify the installed edition/version and endpoint exposure, test supported authentication and redirect destinations, and retain federation configuration and change-test evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Version 14.0.6 disables legacy Liberty ID-FF endpoints and can disrupt dependent federation. The separately linked OpenIdentityPlatform 16.1.4 advisory concerns another maintained edition; do not substitute its version range or score.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
