Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

OpenIdentityPlatform — Vulnerabilities & Security Advisories 34

Browse all 34 CVE security advisories affecting OpenIdentityPlatform. AI-powered Chinese analysis, POCs, and references for each vulnerability.

OpenIdentityPlatform provides identity and access management solutions for enterprises, handling authentication and authorization across systems. Historically, it has been susceptible to remote code execution, cross-site scripting, and privilege escalation vulnerabilities, often stemming from improper input validation and insecure default configurations. The platform's five recorded CVEs highlight ongoing security challenges, with some instances allowing attackers to bypass authentication controls or execute arbitrary code. While no major public incidents have been widely documented, the consistent appearance of critical vulnerabilities in its history suggests organizations should implement rigorous hardening measures and prompt patching to mitigate potential risks.

Top products by OpenIdentityPlatform: OpenAM OpenDJ
CVE ID Title CVSS Severity Published
CVE-2026-105122 OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri — OpenAM CWE-918 5.4 Medium 2026-10-03
CVE-2026-105121 OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping — OpenAM CWE-285 4.9 Medium 2026-10-03
CVE-2026-105120 OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint — OpenAM CWE-200 4.9 Medium 2026-10-03
CVE-2026-105119 OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows — OpenAM CWE-285 6.8 Medium 2026-10-03
CVE-2026-105118 OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession — OpenAM CWE-347 4.7 Medium 2026-10-03
CVE-2026-105116 OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page — OpenAM CWE-79 6.1 Medium 2026-10-03
CVE-2026-105117 OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions — OpenAM CWE-20 6.1 Medium 2026-10-03
CVE-2026-105115 OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface — OpenAM CWE-306 8.6 High 2026-10-03
CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page — OpenAM CWE-79 6.1 Medium 2026-10-03
CVE-2026-46495 OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI — OpenDJ CWE-502 9.2 Critical 2026-09-15
CVE-2026-48717 OpenAM OAuth Authorization Bypass via PKCE Challenge — OpenAM CWE-285 9.1 Critical 2026-09-15
CVE-2026-47426 OpenAM OAuth Client Impersonation via JWKS Resolver Cache — OpenAM CWE-287 7.6 High 2026-09-15
CVE-2026-47424 OpenAM Authenticated RCE via Groovy Sandbox Escape — OpenAM CWE-693 7.5 High 2026-09-15
CVE-2026-41573 OpenAM LDAP Injection via `_queryId` Parameter — OpenAM CWE-90 7.1 High 2026-09-15
CVE-2026-62280 OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page — OpenAM CWE-79 6.1 Medium 2026-09-15
CVE-2026-45051 OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage — OpenAM CWE-502 9.2 Critical 2026-09-15
CVE-2026-62263 OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass — OpenAM CWE-502 9.2 Critical 2026-09-15
CVE-2026-46623 OpenAM Account Takeover via Unverified Password Change in OAuth2 Module — OpenAM CWE-620 7.4 High 2026-09-15
CVE-2026-46619 OpenAM Authentication Bypass via MSISDN LDAP Injection — OpenAM CWE-90 9.3 Critical 2026-09-15
CVE-2026-46498 OpenAM Arbitrary OAuth Token Minting via Push Registration — OpenAM CWE-639 7.6 High 2026-09-15
CVE-2026-45794 OpenAM Unsafe Java Deserialization via SNS — OpenAM CWE-502 7.7 High 2026-09-15
CVE-2026-45048 OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC — OpenAM CWE-200 8.5 High 2026-09-15
CVE-2026-44203 OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl) — OpenAM CWE-79 8.3 High 2026-09-15
CVE-2026-44202 OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice` — OpenAM CWE-918 5.3 Medium 2026-09-15
CVE-2026-62379 OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback — OpenAM CWE-94 9.8 Critical 2026-09-15
CVE-2026-53660 OpenAM Insecure SSO Cookie Initialization — OpenAM CWE-1004 7.4 High 2026-09-15
CVE-2026-45052 OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints — OpenAM CWE-285 9.3 Critical 2026-09-15
CVE-2026-44793 OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget` — OpenAM CWE-79 7.0 High 2026-09-15
CVE-2026-73644 OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grant — OpenDJ CWE-285 9.6 Critical 2026-08-13
CVE-2026-33439 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM — OpenAM CWE-502 9.8AI Critical AI 2026-04-07

This page lists every published CVE security advisory associated with OpenIdentityPlatform. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.