OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security

OpenAM Authentication Bypass via MSISDN LDAP Injection

OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

OpenAM OAuth Authorization Bypass via PKCE Challenge

OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC

OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_info

OpenAM Unsafe Java Deserialization via SNS

OpenAM OAuth Client Impersonation via JWKS Resolver Cache

OpenAM Arbitrary OAuth Token Minting via Push Registration

OpenAM Authenticated RCE via Groovy Sandbox Escape

OpenAM Account Takeover via Unverified Password Change in OAuth2 Module

OpenAM Insecure SSO Cookie Initialization

OpenAM LDAP Injection via `_queryId` Parameter

OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`

OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows

OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions

OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page

OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri

OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`

The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."

OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping

OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint

OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession