What’s Vulnerable › Products

OpenIdentityPlatform OpenAM vulnerabilities

32 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 29 published in the last 12 months.

Check whether your OpenIdentityPlatform OpenAM version is affected

Latest OpenIdentityPlatform OpenAM vulnerabilities

• CVE-2026-105122 — OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri (CVSS 5.4)
• CVE-2026-105121 — OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping (CVSS 4.9)
• CVE-2026-105120 — OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint (CVSS 4.9)
• CVE-2026-105119 — OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows (CVSS 6.8)
• CVE-2026-105118 — OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession (CVSS 4.7)
• CVE-2026-105117 — OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions (CVSS 6.1)
• CVE-2026-105116 — OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page (CVSS 6.1)
• CVE-2026-105115 — OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface (CVSS 8.6)
• CVE-2026-105114 — OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page (CVSS 6.1)
• CVE-2026-62379 — OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback (CVSS 9.8)
• CVE-2026-62280 — OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page (CVSS 6.1)
• CVE-2026-62263 — OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass (CVSS 9.2)
• CVE-2026-53660 — OpenAM Insecure SSO Cookie Initialization (CVSS 7.4)
• CVE-2026-48717 — OpenAM OAuth Authorization Bypass via PKCE Challenge (CVSS 9.1)
• CVE-2026-47426 — OpenAM OAuth Client Impersonation via JWKS Resolver Cache (CVSS 7.6)
• CVE-2026-47424 — OpenAM Authenticated RCE via Groovy Sandbox Escape (CVSS 7.5)
• CVE-2026-46623 — OpenAM Account Takeover via Unverified Password Change in OAuth2 Module (CVSS 7.4)
• CVE-2026-46619 — OpenAM Authentication Bypass via MSISDN LDAP Injection (CVSS 9.3)
• CVE-2026-46498 — OpenAM Arbitrary OAuth Token Minting via Push Registration (CVSS 7.6)
• CVE-2026-45794 — OpenAM Unsafe Java Deserialization via SNS (CVSS 7.7)
• CVE-2026-45052 — OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints (CVSS 9.3)
• CVE-2026-45051 — OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage (CVSS 9.2)
• CVE-2026-45048 — OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC (CVSS 8.5)
• CVE-2026-44793 — OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget` (CVSS 7.0)
• CVE-2026-44203 — OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl) (CVSS 8.3)