OP
Product
OpenAM
31
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 8High 12Medium 11Low 0
Watch
Add OpenAM to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-105115 | 8.6 | Oct 3 | OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface Affected: before 16.1.3 |
| CVE-2026-45048 | 8.5 | Sep 15 | OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC Affected: < 16.1.1 |
| CVE-2026-44203 | 8.3 | Sep 15 | OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl) Affected: < 16.1.1 |
| CVE-2025-64099 | 8.1 | Nov 12 | OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_info Affected: < 16.0.0 |
| CVE-2026-45794 | 7.7 | Sep 15 | OpenAM Unsafe Java Deserialization via SNS Affected: < 16.1.1 |
| CVE-2026-47426 | 7.6 | Sep 15 | OpenAM OAuth Client Impersonation via JWKS Resolver Cache Affected: < 16.1.1 |
| CVE-2026-46498 | 7.6 | Sep 15 | OpenAM Arbitrary OAuth Token Minting via Push Registration Affected: < 16.1.1 |
| CVE-2026-47424 | 7.5 | Sep 15 | OpenAM Authenticated RCE via Groovy Sandbox Escape Affected: < 16.1.1 |
| CVE-2026-46623 | 7.4 | Sep 15 | OpenAM Account Takeover via Unverified Password Change in OAuth2 Module Affected: < 16.1.1 |
| CVE-2026-53660 | 7.4 | Sep 15 | OpenAM Insecure SSO Cookie Initialization Affected: < 16.1.1 |
| CVE-2026-41573 | 7.1 | Sep 15 | OpenAM LDAP Injection via `_queryId` Parameter Affected: < 16.1.1 |
| CVE-2026-44793 | 7.0 | Sep 15 | OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget` Affected: < 16.1.1 |
Showing 12