Login Request a demo
OP
Product
OpenAM
by OpenIdentityPlatform · last CVE Oct 3, 2026
31
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Vulnerabilities31In the news0Timeline
Severity mix
Critical 8High 12Medium 11Low 0
Severity
All severities31Critical8High12Medium11Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add OpenAM to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-105119
6.8
0%
Oct 3
OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows
Affected: before 16.1.3
CVE-2026-105117
6.1
0%
Oct 3
OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions
Affected: before 16.1.3; before 16.1.3
CVE-2026-105116
6.1
0%
Oct 3
OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page
Affected: before 16.1.3; before 16.1.3; before 16.1.3
CVE-2026-105114
6.1
0%
Oct 3
OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page
Affected: before 16.1.3
CVE-2026-62280
6.1
0%
Sep 15
OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
Affected: >= 13.0.0, < 16.1.2
CVE-2026-105122
5.4
0%
Oct 3
OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri
Affected: before 16.1.3
CVE-2026-44202
5.3
0%
Sep 15
OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`
Affected: < 16.1.1
CVE-2022-34298
5.3
3%
Jun 23
The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."
Affected: before 14.6.6
CVE-2026-105121
4.9
0%
Oct 3
OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping
Affected: before 16.1.3
CVE-2026-105120
4.9
0%
Oct 3
OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint
Affected: before 16.1.3; before 16.1.3
CVE-2026-105118
4.7
0%
Oct 3
OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession
Affected: before 16.1.3
Showing 11