OpenIdentityPlatform

Records37All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical10CVSS 9.0–10.0

CVSS high17CVSS 7.0–8.9

Exploited now

OpenIdentityPlatform records in CISA KEV

No OpenIdentityPlatform vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Openam 3 records MEDIUM

Records

37 records

TI-2025-20332 CVE-2025-27497 · GHSA-93qr-h8pr-4593

OpenDJ Denial of Service (Dos) using alias loop

HIGH 77

OpenDJ is an LDAPv3 compliant directory service.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00389 Published 2025-03-05 Fixed in 4.9.3 CWE-835

TI-2026-25836 CVE-2026-33439 · GHSA-2cqq-rpvq-g5qj

Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

MEDIUM 60

Open Access Management (OpenAM) is an access management solution.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.09333 Published 2026-04-07 Fixed in 16.0.6 CWE-502

TI-2026-44519 CVE-2026-62379 · GHSA-wg5r-wc3x-39vc

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

MEDIUM 51

Open Access Management (OpenAM) is an access management solution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01066 Published 2026-09-15 Fixed in 16.1.2 CWE-470

TI-2023-19079 CVE-2023-37471 · GHSA-4mh8-9wq6-rjxg

User impersonation using SAMLv1.x SSO in Open Access Management

MEDIUM 51

Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0126 Published 2023-07-20 Fixed in 14.7.3 CWE-287

TI-2026-34275 CVE-2026-46619 · GHSA-xq73-fvmr-jvmm

OpenAM Authentication Bypass via MSISDN LDAP Injection

MEDIUM 50

Open Access Management (OpenAM) is an access management solution.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00992 Published 2026-09-15 Fixed in 16.1.1 CWE-90

TI-2026-32901 CVE-2026-45052 · GHSA-p462-xxwx-pqf4

OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

MEDIUM 49

Open Access Management (OpenAM) is an access management solution.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00765 Published 2026-09-15 Fixed in 16.1.1 CWE-285

TI-2024-27729 CVE-2024-41667 · GHSA-7726-43hg-m23v

OpenAM FreeMarker template injection

MEDIUM 46

OpenAM is an open access management solution.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03536 Published 2024-07-24 Fixed in 15.0.4 CWE-94

TI-2026-67490 CVE-2026-105115 · GHSA-45wm-hvw4-223f

OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

MEDIUM 44

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00461 Published 2026-10-03 Fixed in 16.1.3 CWE-306

TI-2026-34193 CVE-2026-46495 · GHSA-43x2-g84q-fmqx

OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

MEDIUM 44

OpenDJ is an LDAPv3 compliant directory service.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01131 Published 2026-09-15 Fixed in 5.1.1 CWE-502

TI-2026-51728 CVE-2026-73644 · GHSA-p279-2cqp-84jg

Improper authorization in OpenIdentityPlatform OpenDJ

MEDIUM 43

OpenDJ is an LDAPv3 compliant directory service.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00413 Published 2026-08-13 Fixed in 5.1.2 CWE-285

TI-2026-44471 CVE-2026-62263 · GHSA-gf8h-gq53-288j

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

MEDIUM 43

Open Access Management (OpenAM) is an access management solution.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0086 Published 2026-09-15 Fixed in 16.1.2 CWE-502

TI-2026-32900 CVE-2026-45051 · GHSA-6c99-87fr-6q7r

OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

MEDIUM 43

Open Access Management (OpenAM) is an access management solution.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00688 Published 2026-09-15 Fixed in 16.1.1 CWE-502

TI-2025-39550 CVE-2025-64099 · GHSA-39hr-239p-fhqc

OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_info

MEDIUM 43

Open Access Management (OpenAM) is an access management solution.

CVSS 4.0HIGH 8.1 Network No auth No interaction EPSS 0.00353 Published 2025-11-12 Fixed in 16.0.0, 16.0.3 CWE-74

TI-2026-34279 CVE-2026-46623 · GHSA-gf57-4mp6-m85x

OpenAM Account Takeover via Unverified Password Change in OAuth2 Module

MEDIUM 42

Open Access Management (OpenAM) is an access management solution.

CVSS 4.0HIGH 7.4 Network No auth User interaction EPSS 0.00669 Published 2026-09-15 Fixed in 16.1.1 CWE-1391

TI-2026-35998 CVE-2026-48717 · GHSA-4v2w-2wqp-mc85

OpenAM OAuth Authorization Bypass via PKCE Challenge

MEDIUM 40

Open Access Management (OpenAM) is an access management solution.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00529 Published 2026-09-15 Fixed in 16.1.1 CWE-285

TI-2026-34989 CVE-2026-47426 · GHSA-f2cx-463q-7m2c

OpenAM OAuth Client Impersonation via JWKS Resolver Cache

MEDIUM 40

Open Access Management (OpenAM) is an access management solution.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00554 Published 2026-09-15 Fixed in 16.1.1 CWE-287

TI-2026-32899 CVE-2026-45048 · GHSA-vvhj-w2jq-263q

OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC

LOW 39

Open Access Management (OpenAM) is an access management solution.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00428 Published 2026-09-15 Fixed in 16.1.1 CWE-200

TI-2026-32182 CVE-2026-44203 · GHSA-fq9h-c788-fx73

OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

LOW 39

Open Access Management (OpenAM) is an access management solution.

CVSS 4.0HIGH 8.3 Network No auth User interaction EPSS 0.00593 Published 2026-09-15 Fixed in 16.1.1 CWE-79

TI-2026-82770 CVE-2026-45049

OpenAM Session Hijacking via CDSSO

LOW 38

Open Access Management (OpenAM) is an access management solution.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00332 Published 2026-10-29 Fixed in 16.1.1 CWE-201

TI-2026-33529 CVE-2026-45794 · GHSA-pp89-732f-3g8q

OpenAM Unsafe Java Deserialization via SNS

LOW 37

Open Access Management (OpenAM) is an access management solution.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00627 Published 2026-09-15 Fixed in 16.1.1 CWE-502

TI-2026-67494 CVE-2026-105119 · GHSA-mf8f-w84m-x4gc

OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows

LOW 35

OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through OpenID Connect hybrid flows (code token, code id_token, code t…

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00196 Published 2026-10-03 Fixed in 16.1.3 CWE-285

TI-2026-38701 CVE-2026-53660 · GHSA-fpmh-vx4h-xc33

OpenAM Insecure SSO Cookie Initialization

LOW 35

Open Access Management (OpenAM) is an access management solution.

CVSS 4.0HIGH 7.4 Network No auth User interaction EPSS 0.00409 Published 2026-09-15 Fixed in 16.1.1 CWE-1004

TI-2026-34987 CVE-2026-47424 · GHSA-69j4-qvqr-hpw3

OpenAM Authenticated RCE via Groovy Sandbox Escape

LOW 35

Open Access Management (OpenAM) is an access management solution.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00483 Published 2026-09-15 Fixed in 16.1.1 CWE-693

TI-2026-34196 CVE-2026-46498 · GHSA-cj8f-2fhf-826r

OpenAM Arbitrary OAuth Token Minting via Push Registration

LOW 35

Open Access Management (OpenAM) is an access management solution.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00414 Published 2026-09-15 Fixed in 16.1.1 CWE-639

TI-2026-83286 CVE-2026-46560

Authentication bypass in OpenAM via RADIUS packet spoofing

LOW 34

Open Access Management (OpenAM) is an access management solution.

CVSS 3.1HIGH 7.5 Adjacent network No auth No interaction EPSS 0.00186 Published 2026-10-30 Fixed in 16.1.1 CWE-347

Open these records in search →