Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

OpenAM — Vulnerabilities & Security Advisories 34

All 34 CVE vulnerabilities found in OpenAM, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities for Oracle's OpenAM product, classified under the OpenAM product tag. It collects a comprehensive set of historical security advisories, covering the full time range from the product's initial release through the most recent updates. Here, users can track the vendor's security advisories, understand the specific weakness class, and look up the product's complete vulnerability history.

Vendor: Open Source Solution Technology Corporation

CVE ID Title CVSS Severity Published
CVE-2026-105122 OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri CWE-918 5.4 Medium 2026-10-03
CVE-2026-105121 OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping CWE-285 4.9 Medium 2026-10-03
CVE-2026-105119 OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows CWE-285 6.8 Medium 2026-10-03
CVE-2026-105120 OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint CWE-200 4.9 Medium 2026-10-03
CVE-2026-105118 OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession CWE-347 4.7 Medium 2026-10-03
CVE-2026-105116 OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page CWE-79 6.1 Medium 2026-10-03
CVE-2026-105117 OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions CWE-20 6.1 Medium 2026-10-03
CVE-2026-105115 OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface CWE-306 8.6 High 2026-10-03
CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page CWE-79 6.1 Medium 2026-10-03
CVE-2026-48717 OpenAM OAuth Authorization Bypass via PKCE Challenge CWE-285 9.1 Critical 2026-09-15
CVE-2026-47426 OpenAM OAuth Client Impersonation via JWKS Resolver Cache CWE-287 7.6 High 2026-09-15
CVE-2026-47424 OpenAM Authenticated RCE via Groovy Sandbox Escape CWE-693 7.5 High 2026-09-15
CVE-2026-41573 OpenAM LDAP Injection via `_queryId` Parameter CWE-90 7.1 High 2026-09-15
CVE-2026-62280 OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page CWE-79 6.1 Medium 2026-09-15
CVE-2026-45051 OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage CWE-502 9.2 Critical 2026-09-15
CVE-2026-62263 OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass CWE-502 9.2 Critical 2026-09-15
CVE-2026-46623 OpenAM Account Takeover via Unverified Password Change in OAuth2 Module CWE-620 7.4 High 2026-09-15
CVE-2026-46619 OpenAM Authentication Bypass via MSISDN LDAP Injection CWE-90 9.3 Critical 2026-09-15
CVE-2026-46498 OpenAM Arbitrary OAuth Token Minting via Push Registration CWE-639 7.6 High 2026-09-15
CVE-2026-45794 OpenAM Unsafe Java Deserialization via SNS CWE-502 7.7 High 2026-09-15
CVE-2026-45048 OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC CWE-200 8.5 High 2026-09-15
CVE-2026-44203 OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl) CWE-79 8.3 High 2026-09-15
CVE-2026-44202 OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice` CWE-918 5.3 Medium 2026-09-15
CVE-2026-62379 OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback CWE-94 9.8 Critical 2026-09-15
CVE-2026-53660 OpenAM Insecure SSO Cookie Initialization CWE-1004 7.4 High 2026-09-15
CVE-2026-45052 OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints CWE-285 9.3 Critical 2026-09-15
CVE-2026-44793 OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget` CWE-79 7.0 High 2026-09-15
CVE-2026-33439 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM CWE-502 9.8AI Critical AI 2026-04-07
CVE-2025-64099 OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_info CWE-74 4.3 - 2025-11-12
CVE-2025-8662 OpenAM 安全漏洞 7.5AI High AI 2025-09-02

All 34 known CVE vulnerabilities affecting OpenAM with full Chinese analysis, references, and POCs where available.