Skip to content
Openidentityplatform vulnerabilities
Newest
-
openidentityplatform openam
OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri
CVE-2026-105122
5.3 Medium
-
openidentityplatform openam
OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping
CVE-2026-105121
6.9 Medium
-
openidentityplatform openam
OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint
CVE-2026-105120
6.9 Medium
-
openidentityplatform openam
OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows
CVE-2026-105119
7.6 High
-
openidentityplatform openam
OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession
CVE-2026-105118
2.3 Low
-
openidentityplatform openam
OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions
CVE-2026-105117
5.3 Medium
-
openidentityplatform openam
OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page
CVE-2026-105116
5.1 Medium
-
openidentityplatform openam
OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface
CVE-2026-105115
8.8 High
-
openidentityplatform openam
OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page
CVE-2026-105114
5.3 Medium
-
openidentityplatform openam
OpenAM Insecure SSO Cookie Initialization
CVE-2026-53660
Fix available
7.4 High
-
openidentityplatform opendj
OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grant
CVE-2026-73644
Fix available
9.6 Critical
-
openidentityplatform openam
OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback
CVE-2026-62379
Fix available
9.8 Critical
-
openidentityplatform openam
OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
CVE-2026-62280
Fix available
6.1 Medium
-
openidentityplatform openam
OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
CVE-2026-62263
Fix available
9.2 Critical
-
openidentityplatform openam
OpenAM OAuth Authorization Bypass via PKCE Challenge
CVE-2026-48717
Fix available
9.1 Critical
-
openidentityplatform openam
OpenAM OAuth Client Impersonation via JWKS Resolver Cache
CVE-2026-47426
Fix available
7.6 High
-
openidentityplatform openam
OpenAM Authenticated RCE via Groovy Sandbox Escape
CVE-2026-47424
Fix available
7.5 High
-
openidentityplatform openam
OpenAM Account Takeover via Unverified Password Change in OAuth2 Module
CVE-2026-46623
Fix available
7.4 High
-
openidentityplatform openam
OpenAM Authentication Bypass via MSISDN LDAP Injection
CVE-2026-46619
Fix available
9.3 Critical
-
openidentityplatform openam
OpenAM Authentication Bypass via RADIUS Spoofing
CVE-2026-46560
Fix available
7.5 High
-
openidentityplatform openam
OpenAM Arbitrary OAuth Token Minting via Push Registration
CVE-2026-46498
Fix available
7.6 High
-
openidentityplatform openam
OpenAM Unsafe Java Deserialization via SNS
CVE-2026-45794
Fix available
7.7 High
-
openidentityplatform openam
OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints
CVE-2026-45052
Fix available
9.3 Critical
-
openidentityplatform openam
OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage
CVE-2026-45051
Fix available
9.2 Critical
-
openidentityplatform openam
OpenAM Session Hijacking via CDSSO
CVE-2026-45049
Fix available
8.3 High
-
openidentityplatform openam
OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC
CVE-2026-45048
Fix available
8.5 High
-
openidentityplatform opendj, org.openidentityplatform.opendj opendj-server-legacy +1 more
OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI
CVE-2026-46495
Fix available
9.2 Critical
-
openidentityplatform openam
OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`
CVE-2026-44793
Fix available
7.0 High
-
openidentityplatform openam
OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)
CVE-2026-44203
Fix available
8.3 High
-
openidentityplatform openam
OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`
CVE-2026-44202
Fix available
5.3 Medium
-
openidentityplatform openam
OpenAM LDAP Injection via `_queryId` Parameter
CVE-2026-41573
Fix available
7.1 High
-
openidentityplatform openam
Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM
CVE-2026-33439
Public exploitFix available
9.3 Critical
-
openidentityplatform openam
OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_info
CVE-2025-64099
Fix available
8.1 High
-
openam
OpenAM (OpenAM Consortium Edition) contains a vulnerability that may cause it to malfunction as a...
CVE-2025-8662
2.3 Low
-
openidentityplatform opendj
OpenDJ Denial of Service (Dos) using alias loop
CVE-2025-27497
Fix available
8.7 High
-
openidentityplatform openam
OpenAM FreeMarker template injection
CVE-2024-41667
Fix available
8.8 High
-
openidentityplatform openam
User impersonation using SAMLv1.x SSO in Open Access Management
CVE-2023-37471
Fix available
9.1 Critical
-
openidentityplatform openam
NT auth module vulnerability in OpenAM
CVE-2022-34298
Public exploitFix available
5.3 Medium
-
openam consortium openam
OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows...
CVE-2018-0696
7.5 High
-
open source solution technology corporation openam
OpenAM (Open Source Edition) allows an attacker to bypass authentication and access unauthorized...
CVE-2017-10873
8.1 High