Openidentityplatform Openam vulnerabilities

• openidentityplatform openam OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login CVE-2026-123553 6.9 MediumNovember 8, 2026
• openidentityplatform openam OpenAM before 16.1.4 SSRF and CRL Tampering via Certificate CRL Distribution Point CVE-2026-123552 6.3 MediumNovember 8, 2026
• openidentityplatform openam OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket CVE-2026-123551 10.0 CriticalNovember 8, 2026
• openidentityplatform openam OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions CVE-2026-123550 9.3 CriticalNovember 8, 2026
• openidentityplatform openam OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass CVE-2026-123549 9.3 CriticalNovember 8, 2026
• openidentityplatform openam OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages CVE-2026-123548 2.3 LowNovember 8, 2026
• openidentityplatform openam OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState CVE-2026-123547 2.3 LowNovember 8, 2026
• openidentityplatform openam OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFail CVE-2026-123546 5.3 MediumNovember 8, 2026
• openidentityplatform openam OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow CVE-2026-123545 7.1 HighNovember 8, 2026
• openidentityplatform openam OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel CVE-2026-123544 6.1 MediumNovember 8, 2026
• openidentityplatform openam OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java Deserialisation CVE-2026-123543 8.7 HighNovember 8, 2026
• openidentityplatform openam OpenAM before 16.1.4 PKCE Bypass in OAuth 2.0 Device Authorization Flow CVE-2026-123542 7.6 HighNovember 8, 2026
• openidentityplatform openam OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching CVE-2026-123541 5.3 MediumNovember 8, 2026
• openidentityplatform openam OpenAM before 16.1.4 Incomplete Attribute Encoding in SAML 1.x Form POST CVE-2026-123540 2.0 LowNovember 8, 2026
• openidentityplatform openam OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display Name CVE-2026-123539 4.8 MediumNovember 8, 2026
• openidentityplatform openam OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation CVE-2026-123538 7.5 HighNovember 8, 2026
• openidentityplatform openam OpenAM before 16.1.4 SSRF via UMA Scope Description URLs CVE-2026-123537 5.3 MediumNovember 8, 2026
• openidentityplatform openam OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs CVE-2026-123536 5.1 MediumNovember 8, 2026
• openidentityplatform openam OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri CVE-2026-105122 5.3 MediumOctober 3, 2026
• openidentityplatform openam OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping CVE-2026-105121 6.9 MediumOctober 3, 2026
• openidentityplatform openam OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint CVE-2026-105120 6.9 MediumOctober 3, 2026
• openidentityplatform openam OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows CVE-2026-105119 7.6 HighOctober 3, 2026
• openidentityplatform openam OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession CVE-2026-105118 2.3 LowOctober 3, 2026
• openidentityplatform openam OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions CVE-2026-105117 5.3 MediumOctober 3, 2026
• openidentityplatform openam OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page CVE-2026-105116 5.1 MediumOctober 3, 2026
• openidentityplatform openam OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface CVE-2026-105115 8.8 HighOctober 3, 2026
• openidentityplatform openam OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page CVE-2026-105114 5.3 MediumOctober 3, 2026
• openidentityplatform openam OpenAM Insecure SSO Cookie Initialization CVE-2026-53660 Fix available 7.4 HighAugust 14, 2026
• openidentityplatform openam OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback CVE-2026-62379 Fix available 9.8 CriticalJuly 24, 2026
• openidentityplatform openam OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page CVE-2026-62280 Fix available 6.1 MediumJuly 24, 2026
• openidentityplatform openam OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass CVE-2026-62263 Fix available 9.2 CriticalJuly 24, 2026
• openidentityplatform openam OpenAM OAuth Authorization Bypass via PKCE Challenge CVE-2026-48717 Fix available 9.1 CriticalJune 29, 2026
• openidentityplatform openam OpenAM OAuth Client Impersonation via JWKS Resolver Cache CVE-2026-47426 Fix available 7.6 HighJune 29, 2026
• openidentityplatform openam OpenAM Authenticated RCE via Groovy Sandbox Escape CVE-2026-47424 Fix available 7.5 HighJune 29, 2026
• openidentityplatform openam OpenAM Account Takeover via Unverified Password Change in OAuth2 Module CVE-2026-46623 Fix available 7.4 HighJune 26, 2026
• openidentityplatform openam OpenAM Authentication Bypass via MSISDN LDAP Injection CVE-2026-46619 Fix available 9.3 CriticalJune 26, 2026
• openidentityplatform openam OpenAM Authentication Bypass via RADIUS Spoofing CVE-2026-46560 Fix available 7.5 HighJune 25, 2026
• openidentityplatform openam OpenAM Arbitrary OAuth Token Minting via Push Registration CVE-2026-46498 Fix available 7.6 HighJune 25, 2026
• openidentityplatform openam OpenAM Unsafe Java Deserialization via SNS CVE-2026-45794 Fix available 7.7 HighJune 25, 2026
• openidentityplatform openam OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints CVE-2026-45052 Fix available 9.3 CriticalJune 24, 2026
• openidentityplatform openam OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage CVE-2026-45051 Fix available 9.2 CriticalJune 24, 2026
• openidentityplatform openam OpenAM Session Hijacking via CDSSO CVE-2026-45049 Fix available 8.3 HighJune 23, 2026
• openidentityplatform openam OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC CVE-2026-45048 Fix available 8.5 HighJune 23, 2026
• openidentityplatform openam OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget` CVE-2026-44793 Fix available 7.0 HighJune 22, 2026
• openidentityplatform openam OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl) CVE-2026-44203 Fix available 8.3 HighJune 22, 2026
• openidentityplatform openam OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice` CVE-2026-44202 Fix available 5.3 MediumJune 22, 2026
• openidentityplatform openam OpenAM LDAP Injection via `_queryId` Parameter CVE-2026-41573 Fix available 7.1 HighJune 22, 2026
• openidentityplatform openam Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM CVE-2026-33439 Public exploitFix available 9.3 CriticalApril 7, 2026
• openidentityplatform openam OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_info CVE-2025-64099 Fix available 8.1 HighNovember 12, 2025
• openam OpenAM (OpenAM Consortium Edition) contains a vulnerability that may cause it to malfunction as a... CVE-2025-8662 2.3 LowSeptember 2, 2025
• Show olderLoading…