OpenAM versions before 16.1.3 contain a server-side request forgery (SSRF) vulnerability. This flaw allows attackers who can register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwks_uri parameter. Exploitation can lead to unauthenticated internal resource access and potential denial of service by exhausting request threads.
OpenAM versions prior to 16.1.3 have an improper authorization vulnerability that allows delegated administrators with specific session-destroy privileges to terminate sessions outside their authorized realms. This occurs because the realm checks rely on the requester's realm rather than the target session's realm, enabling cross-realm session destruction.
OpenAM versions prior to 16.1.3 have an authorization bypass vulnerability in the sessions REST endpoint. This flaw allows attackers with delegated RealmAdmin privileges to query session information across tenant boundaries by specifying another realm in the _queryFilter parameter. Sensitive data such as usernames, universal IDs, and session handles can be disclosed. The vulnerability has a medium severity score of 6.9 (CVSS 4.0).
OpenAM versions before 16.1.3 have an improper authorization vulnerability in their OAuth2 Provider implementation. Specifically, PKCE enforcement is only applied to authorization requests with response_type exactly equal to 'code'. Hybrid OpenID Connect flows that include 'code token', 'code id_token', or 'code token id_token' do not have this enforcement, allowing intercepted authorization codes to be redeemed by attackers with any non-empty code_verifier.
OpenAM versions before 16.1.3 contain an open redirect vulnerability in the /oauth2/connect/endSession endpoint. This flaw allows unauthenticated attackers to supply an unverified id_token_hint, enabling redirection to any registered post-logout URI. The vulnerability can be exploited for phishing attacks that leverage the trust of the OpenAM host. The issue is classified as low severity with a CVSS 4.0 score of 2.3.
OpenAM versions before 16.1.3 have an email content injection vulnerability that allows unauthenticated attackers to manipulate notification emails sent via the forgotPassword and register actions. Attackers can control the subject and message fields, enabling phishing attacks from the organisation's configured From address or use the register function to relay emails to arbitrary recipients. This vulnerability has a medium severity rating with a CVSS score of 5.3.
OpenAM versions prior to 16.1.3 contain a latent cross-site scripting (XSS) vulnerability. This flaw involves improper neutralization of input during web page generation, where the SAML message, relay state, and target URL are inserted unencoded into a cookie bounce auto-submit page. Exploitation requires the cookieHashRedirectEnabled setting to be enabled. However, an unrelated HTTP 500 error currently prevents exploitation in released versions.
OpenAM versions prior to 16.1.3 have a vulnerability in the legacy JAX-RPC SOAP interface that allows unauthenticated remote attackers to instantiate arbitrary classes. This flaw enables attackers to send SOAP requests with unverified session identifiers and chosen class names, potentially crashing the server, probing the classpath, or achieving code execution via gadget chains. The vulnerability has a high severity score of 8.8 (CVSS 4.0).
OpenAM versions before 16.1.3 have a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious scripts via crafted parameters on the OAuth2 authorization error page. Exploitation requires tricking users into visiting a specially crafted URL, enabling script execution in the context of the OpenAM origin. This can lead to actions within existing user sessions or redirection to phishing sites.
OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector.java processes attacker-controlled credential objects before authentication without a restrictive jmx.remote.rmi.server.credentials.filter.pattern, and RmiAuthenticator.authenticate in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiAuthenticator.java accepts an unconstrained Object array rather than a two-element String[]. When the JMX Connection Handler is enabled and its TCP listener is reachable, an unauthenticated remote attacker can submit a crafted serialized Java object and achieve code execution in the OpenDJ server process. The handler is disabled by default, and successful exploitation depends on the runtime classpath and Java version; remote code execution was demonstrated against OpenDJ 4.4.15 on JDK 11 with Jackson 2.12.6.1. This issue is fixed in 5.1.1.
Open Access Management (OpenAM) is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an active OpenAM session to follow a crafted authorization link and execute JavaScript in the OpenAM origin, enabling session or cookie theft, CSRF-token disclosure, and actions with the victim's privileges. At least one registered OAuth2 client is required, but the attacker does not need to control that client. This issue is fixed in version 16.1.2.
CVE-2026-62263 is a critical deserialization vulnerability in OpenIdentityPlatform's OpenAM prior to version 16.1.2. The flaw arises because the WebAuthnAuthentication.deserialize method applies an ObjectInputFilter that insufficiently restricts serialized objects beyond the root AuthenticatorImpl object, allowing nested malicious gadget classes to execute code during deserialization. This vulnerability enables a pre-authentication attacker to bypass previous mitigations by supplying a crafted userHandle with a valid root object but malicious nested payloads. The issue is resolved in OpenAM version 16.1.2.
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId parameter from /json/{realm}/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches DJLDAPv3Repo.getFilter(), where it is concatenated into an LDAP filter, allowing an authenticated attacker to inject LDAP metacharacters for user enumeration and blind LDAP injection. This issue is fixed in version 16.1.1.
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorImpl object graph from the configured userAttribute through loadAuthenticators without an ObjectInputFilter. Exploitation requires the WebAuthn flow to be reachable and an attacker to have previously written controlled data to that attribute through delegated administration, provisioning, directory access, legacy REST self-registration, or unsafe configuration. When those non-default conditions hold, the data is deserialized before assertion verification and can execute a classpath gadget in the application server process. This issue is fixed in version 16.1.1.
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers from the shared Core Token Store (CTS) without an OAuth-only namespace, and OAuthAdapter accepts a row whose BLOB claims to contain an OAuth token without binding the trusted CTS type or verifying integrity. An attacker who can place controlled JSON in CTS under a known token identifier, such as through Push Registration followed by an anonymous SNS callback in an enabled realm, can mint OAuth bearer tokens and OpenID Connect ID tokens with chosen subject, client, realm, and scope. The flaw does not by itself create an OpenAM SSO session or grant console access. This issue is fixed in version 16.1.1.
CVE-2026-45794 is a deserialization vulnerability in OpenIdentityPlatform's OpenAM prior to version 16.1.1. It involves the anonymous Push Notification SNS callback handling, where attacker-controlled JSON is deserialized through Jackson after a messageId expires. This allows a low-privileged user to trigger class loading and object construction in the OpenAM JVM, potentially leading to classpath-dependent process execution, file writes, or denial of service. The vulnerability is fixed in version 16.1.1.
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session storage. A requester who knows a target identity identifier can retrieve another user's active session credentials, including credentials for a more privileged account, and use them to hijack that session. This issue is fixed in version 16.1.1.
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the form_post response mode. An unauthenticated attacker can induce a user to open a crafted authorization request and execute script in the OpenAM origin. This issue is fixed in version 16.1.1.
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. SessionRequestHandler passes the attacker-controlled destination to the session listener service, causing the OpenAM server to make outbound requests and potentially disclose session-related notification data to an attacker-controlled destination. This issue is fixed in version 16.1.1.
OpenIdentityPlatform OpenAM versions prior to 16.1.1 contain an improper authorization vulnerability in the Liberty Web Services SOAP receiver. This flaw allows unauthenticated remote attackers to write persistent entries into a user's Liberty Discovery store and the shared root-realm Discovery branch. The vulnerability arises because server-side handlers bypass LDAP and identity ACLs, using an internal administrative token for global paths. This can lead to manipulated service-routing or security-mechanism records in deployments consuming Liberty discovery data. The issue is fixed in version 16.1.1.