Login Request a demo
OP
Product
OpenAM
by OpenIdentityPlatform · last CVE Oct 3, 2026
31
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Vulnerabilities31In the news0Timeline
Severity mix
Critical 8High 12Medium 11Low 0
Severity
All severities31Critical8High12Medium11Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add OpenAM to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-62379
9.8
1%
Sep 15
OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback
Affected: < 16.1.2
CVE-2026-33439
9.8
9%
Apr 7
Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM
Affected: < 16.0.6
CVE-2023-37471
9.8
1%
Jul 20
Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security
Affected: before 14.7.3
CVE-2026-46619
9.3
1%
Sep 15
OpenAM Authentication Bypass via MSISDN LDAP Injection
Affected: < 16.1.1
CVE-2026-45052
9.3
1%
Sep 15
OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints
Affected: < 16.1.1
CVE-2026-45051
9.2
1%
Sep 15
OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage
Affected: < 16.1.1
CVE-2026-62263
9.2
1%
Sep 15
OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
Affected: < 16.1.2
CVE-2026-48717
9.1
1%
Sep 15
OpenAM OAuth Authorization Bypass via PKCE Challenge
Affected: < 16.1.1
Showing 8