Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

37 records

Vendor: OpenIdentityPlatform Clear all filters
TI-2026-82770 CVE-2026-45049

OpenAM Session Hijacking via CDSSO

Priority LOW 38

Open Access Management (OpenAM) is an access management solution.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00332 Published 2026-10-29 Fixed in 16.1.1 CWE-201
TI-2026-67497 CVE-2026-105122 · GHSA-r8x8-66rr-q5w2

OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri

Priority LOW 24

OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwks_uri.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00232 Published 2026-10-03 Fixed in 16.1.3 CWE-918
TI-2026-67495 CVE-2026-105120 · GHSA-55ch-4xvx-7w9q

OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint

Priority LOW 30

OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00264 Published 2026-10-03 Fixed in 16.1.3 CWE-200
TI-2026-67494 CVE-2026-105119 · GHSA-mf8f-w84m-x4gc

OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows

Priority LOW 35

OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through OpenID Connect hybrid flows (code token, code id_token, code t…

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00196 Published 2026-10-03 Fixed in 16.1.3 CWE-285
TI-2026-67493 CVE-2026-105118 · GHSA-mxvw-rw3m-5c33

OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession

Priority LOW 11

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.001 Published 2026-10-03 Fixed in 16.1.3 CWE-347
TI-2026-67492 CVE-2026-105117 · GHSA-35wg-cp3w-fh5v

OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions

Priority LOW 23

OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/{realm}/users.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00162 Published 2026-10-03 Fixed in 16.1.3 CWE-20
TI-2026-67491 CVE-2026-105116 · GHSA-wxcf-pvf2-p2h6

OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page

Priority LOW 28

OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce auto-submit page.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00155 Published 2026-10-03 Fixed in 16.1.3 CWE-79
TI-2026-67489 CVE-2026-105114 · GHSA-875h-jw66-233j

OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

Priority LOW 23

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error pag…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00173 Published 2026-10-03 Fixed in 16.1.3 CWE-79
TI-2026-30128 CVE-2026-41573 · GHSA-2vg8-q4c2-5cw3

OpenAM LDAP Injection via `_queryId` Parameter

Priority LOW 32

Open Access Management (OpenAM) is an access management solution.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00496 Published 2026-09-15 Fixed in 16.1.1 CWE-90
TI-2026-33529 CVE-2026-45794 · GHSA-pp89-732f-3g8q

OpenAM Unsafe Java Deserialization via SNS

Priority LOW 37

Open Access Management (OpenAM) is an access management solution.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00627 Published 2026-09-15 Fixed in 16.1.1 CWE-502
Load more