Improper authentication in OpenAM
Priority MEDIUM 40CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
OpenAM (Open Source Edition) allows an attacker to bypass authentication and access unauthorized contents via unspecified vectors. Note that this vulnerability affects OpenAM (Open Source Edition) implementations configured as SAML 2.0IdP, and switches authentication methods based on AuthnContext requests sent from the service provider.
Why it matters now
EPSS 0.02625 85th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Open Source Solution Technology Corporation | OpenAM | Open Source Edition | — | No fix listed | CNA |
- OpenAM VendorOpen Source Solution Technology Corporation Affected Open Source Edition Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:osstech:openam:*:*:*:*:open_source:*:*:* | 9.5.5 – 9.5.5-41; 11.0.0 – 11.0.0-112; 13.0.0 – 13.0.0-73 | Vulnerable | Osstech |
- cpe:2.3:a:osstech:openam:*:*:*:*:open_source:*:*:* Versions 9.5.5 – 9.5.5-41; 11.0.0 – 11.0.0-112; 13.0.0 – 13.0.0-73 Vulnerable ·Osstech
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-10873
- 2026-10-03 Alias added: GHSA-4rxj-vw6j-qqrf
References
More Osstech Openam vulnerabilities
- TI-2018-00651 Weak password recovery in OpenAM CVSS 3.0HIGH 7.5
- TI-2019-04211 Open redirect in OpenAM CVSS 3.0MEDIUM 6.1
- TI-2022-13631 Open redirect in OpenAM CVSS 3.1MEDIUM 6.1
Sources
- CVE-2017-10873 · CVE Program
- CVE-2017-10873 · NVD
- FIRST EPSS
- GHSA-4rxj-vw6j-qqrf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences