CVE-2026-105116 Overview
CVE-2026-105116 is a latent cross-site scripting (XSS) vulnerability in OpenAM versions before 16.1.3. The flaw resides in the SAML load-balancer cookie bounce auto-submit page, which writes the SAML message, relay state, and target URL into the response without proper HTML encoding. When cookieHashRedirectEnabled is set and the endpoint is reachable, a crafted request could execute attacker-controlled script in the OpenAM origin. An unrelated HTTP 500 failure path in released versions prevents reliable exploitation today, which is why the issue is classified as latent. The weakness is tracked as [CWE-79].
Critical Impact
Successful exploitation would execute script in the OpenAM origin, enabling session theft or SAML flow manipulation if the blocking HTTP 500 condition is removed in a future change.
Affected Products
- Open Identity Platform OpenAM versions prior to 16.1.3
- Deployments with cookieHashRedirectEnabled configured
- SAML federation endpoints using the load-balancer cookie bounce page
Discovery Timeline
- 2026-10-03 - CVE-2026-105116 published to the National Vulnerability Database (NVD)
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-105116
Vulnerability Analysis
The defect lives in the auto-submit HTML page that OpenAM returns to clients during SAML load-balancer cookie bouncing. The page echoes three attacker-influenceable fields into the response body without HTML entity encoding: the SAML message, the relay state, and the target URL. A browser that receives this response renders the injected markup inside the OpenAM origin, bringing session cookies and SAML artifacts within reach of the injected script.
The vulnerable code path only runs when the cookieHashRedirectEnabled setting is active. In the released code base an unrelated HTTP 500 error occurs before the browser executes the response, which keeps the flaw latent. Any future refactor that removes the error condition would make the XSS directly exploitable.
Root Cause
The root cause is missing output encoding when request-controlled values are serialized into an HTML <form> auto-submit template. OpenAM treats the SAML message, relay state, and target URL as safe strings instead of untrusted input requiring context-aware escaping before insertion into the HTML body.
Attack Vector
Exploitation requires a victim to interact with a crafted link that targets the OpenAM cookie bounce endpoint on an instance with cookieHashRedirectEnabled set. The attacker supplies malicious SAML, relay state, or target URL parameters that break out of the surrounding HTML context and inject script. User interaction is required, matching the CVSS vector flag UI:A. Refer to the GitHub Security Advisory GHSA-v796-mg6j-9c5m and the VulnCheck Advisory on OpenAM for additional technical context.
No verified proof-of-concept code has been published. The vulnerability is described in prose by the advising sources and no exploit is listed in Exploit-DB or CISA KEV at the time of writing.
Detection Methods for CVE-2026-105116
Indicators of Compromise
- Requests to OpenAM SAML endpoints that include HTML control characters such as <, >, ", or script tokens inside the SAMLRequest, SAMLResponse, RelayState, or target URL parameters.
- HTTP 500 responses from the cookie bounce auto-submit path, which indicate the vulnerable code path was reached.
- Unexpected outbound requests from client browsers immediately after visiting an OpenAM SAML flow.
Detection Strategies
- Review access logs on OpenAM instances with cookieHashRedirectEnabled enabled and alert on SAML parameters containing script-like payloads.
- Deploy a web application firewall rule that blocks reserved HTML characters inside SAML and relay state parameters at the perimeter.
- Correlate HTTP 500 errors from the load-balancer bounce endpoint with the source IP and user agent to identify probing activity.
Monitoring Recommendations
- Monitor the OpenAM /openam SAML endpoints for anomalous request volume or parameter length spikes.
- Capture full HTTP request bodies for SAML flows during incident investigation to validate parameter contents.
- Track configuration drift so changes to cookieHashRedirectEnabled trigger a security review.
How to Mitigate CVE-2026-105116
Immediate Actions Required
- Upgrade OpenAM to version 16.1.3 or later, which adds proper encoding on the cookie bounce auto-submit page.
- Audit federation deployments for the cookieHashRedirectEnabled setting and disable it where it is not required.
- Restrict network reachability of the load-balancer cookie bounce endpoint to trusted upstream load balancers only.
Patch Information
The fix is included in OpenAM 16.1.3. Administrators should follow the upgrade guidance in the GitHub Security Advisory GHSA-v796-mg6j-9c5m and validate SAML flows after patching.
Workarounds
- Disable cookieHashRedirectEnabled until the upgrade is complete to remove the vulnerable code path from the request pipeline.
- Place a reverse proxy or WAF in front of OpenAM to strip or reject SAML parameters containing HTML metacharacters.
- Apply a strict Content Security Policy (CSP) on OpenAM responses to limit the impact of injected script if the endpoint is reached.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
