OpenAM versions prior to 16.1.4 contain a privilege management vulnerability that allows anonymous attackers to bypass attribute restrictions during self-registration. This flaw enables attackers to assign themselves to administrative groups via legacy self-service REST endpoints or the User Self-Service flow, resulting in full administrative control over OpenAM.
OpenIdentityPlatform OpenAM versions before 16.1.4 contain an open redirect vulnerability. This occurs because certain logout and authentication pages do not validate destination URLs against allowed lists, allowing attackers to craft links that redirect users to arbitrary external sites. The vulnerability has a low CVSS score and is fixed in version 16.1.4.
OpenAM versions prior to 16.1.4 contain an open redirect vulnerability due to improper validation of the RelayState parameter when no relayStateUrlList is configured. This flaw allows attackers to craft single sign-on links that redirect users from the trusted OpenAM origin to external malicious sites, potentially facilitating phishing attacks. The vulnerability has a low CVSS score of 2.3 and was fixed in version 16.1.4.
OpenAM versions before 16.1.4 contain an open redirect and cross-site scripting (XSS) vulnerability. This flaw allows remote attackers to manipulate post-login and logout redirection destinations via the 'goto' and 'gotoOnFail' parameters. Exploitation can lead to redirecting users to phishing sites or executing scripts in the XUI interface to steal session cookies. The vulnerability is fixed in OpenAM version 16.1.4.
OpenAM versions from 14.5.1 up to but not including 16.1.4 contain a cross-site request forgery (CSRF) vulnerability in the OAuth 2.0 device authorization flow. This flaw allows attackers to trick logged-in users into approving device codes without explicit consent for implied-consent clients, potentially granting attackers access and ID tokens to act as the user.
CVE-2026-123544 is a vulnerability in OpenAM versions before 16.1.4 and its client SDK, where insufficient validation of responses on the internal server-to-server SOAP channel allows attackers positioned on the network to impact system integrity and availability. Exploitation can lead to process crashes, tampering with writable files, and potential code execution.
OpenAM versions prior to 16.1.4 contain a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending serialized Java data without size or structure limits. This can disrupt authentication, session validation, and policy decision processes.
OpenAM versions prior to 16.1.4 do not enforce the PKCE security mechanism in the OAuth 2.0 device authorization flow. Specifically, the code verifier is never validated when exchanging device codes for tokens. This flaw allows attackers who obtain a valid device code from client logs or shared device storage to redeem it for access and ID tokens, enabling user impersonation.
OpenAM versions prior to 16.1.4 contain an open redirect vulnerability that allows remote attackers to redirect users to attacker-controlled sites after SAML 1.x single sign-on. This occurs due to loose matching of trusted partner destinations, enabling crafted links to redirect authenticated users to phishing sites.
OpenAM versions before 16.1.4 have an output encoding vulnerability that allows a SAML 1.x identity provider to inject unencoded content into the service provider's auto-submitted form. This can lead to altered attribute values received by the application, compromising attribute integrity. The issue is fixed in version 16.1.4.
OpenAM versions before 16.1.4 contain a stored cross-site scripting (XSS) vulnerability. Privileged attackers can inject malicious script into a user's display name. When a victim views the OAuth 2.0 / OpenID Connect consent page, the injected script executes and can steal the victim's OpenAM session cookie, enabling user impersonation. This vulnerability is fixed in OpenAM version 16.1.4.
OpenAM versions prior to 16.1.4 contain a vulnerability where SAML 1.x assertions or responses are not properly verified to ensure the signature matches the claimed issuer. This allows an attacker with access to any private key in OpenAM's keystore to forge assertions impersonating other trusted partners, including privileged users.
OpenAM versions before 16.1.4 contain a server-side request forgery (SSRF) vulnerability. This flaw allows attackers registering UMA resource sets to specify scope description URLs that trigger internal HTTP requests. These requests can target internal hosts or cloud metadata endpoints when OpenAM sends pending-request notification emails, enabling internal network probing. The vulnerability is fixed in version 16.1.4.
OpenAM versions prior to 16.1.4 contain a server-side request forgery (SSRF) vulnerability that allows administrators, including delegated realm administrators, to cause the server to fetch arbitrary URLs via federation configuration wizard metadata URLs. This can be exploited to probe internal network resources or cloud metadata endpoints and read partial responses.
CVE-2026-123535 is a vulnerability in Tornado versions before 6.6 where the max_age argument of RequestHandler.set_cookie and related methods is not properly validated. This flaw allows an attacker to inject additional Set-Cookie attributes such as Domain, Path, or Secure by supplying attacker-controlled input as max_age, potentially expanding the cookie's scope to parent paths or other subdomains. The issue is fixed in Tornado 6.6.
Tornado versions prior to 6.6 have a path traversal vulnerability in the RequestHandler.static_url() and get_version() methods. This flaw allows attackers to use '../' sequences to access files outside the intended static directory. By controlling input to static_url(), attackers can obtain SHA-512 hashes of readable files to verify their existence or reference special files like /dev/zero to disrupt the event loop.
CVE-2026-123533 is a denial of service vulnerability in gitoxide's gix-commitgraph component before version 0.42.0 and gitoxide before version 0.61.0. The vulnerability arises because the commit-graph parser does not properly validate parent graph positions against the declared commit count and fails to check the EDGE chunk length for 4-byte alignment. This can cause panics that abort commands like gix merge-base, gix blame, and other applications embedding gix when processing a crafted commit-graph file.
CVE-2026-123532 is a vulnerability in gitoxide's gix-fs component before version 0.24.1 that allows remote attackers to capture NTLM credentials on Windows systems. This occurs when a crafted repository contains UNC symlink targets and a victim checks out the repository with symlinks enabled. The vulnerability causes SMB authentication to be triggered, leaking the username, domain, and NTLMv2 hash.
Vikunja versions from 1.0.0 up to but not including 2.7.1 have a vulnerability that allows authenticated users to bypass the service.maxitemsperpage limit by sending page=0 to certain API list endpoints. This triggers unbounded SQL queries and excessive memory use, which can degrade service availability. The issue is fixed in version 2.7.1.
Vikunja versions prior to 2.7.1 have a missing authentication vulnerability that allows an attacker with a stolen session to enroll and enable TOTP (Time-based One-Time Password) without needing the account password. This enables the attacker to set their own TOTP secret, effectively locking the legitimate user out of their account, and this lockout persists even after a password reset.