Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.openidentityplatform.openam:openam-core

5 known vulnerabilities (1 critical, 2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
16.1.4 (Oct 22, 2026): no advisory affects it
Newest unaffected release
16.1.4 (Oct 22, 2026), the latest release
Advisories
5 · 1 critical, 2 high, 1 medium
Dependents
56
Releases
44 since 14.5.2 (Sep 15, 2020)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC

    Affected: fixed in 16.1.1.

    Fixed in 16.1.1 (released Jun 17, 2026, 90 days before disclosure).

    The latest release, 16.1.4, is not affected.

  • CVE-2026-44202Medium 5.3

    OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`

    Affected: fixed in 16.1.1.

    Fixed in 16.1.1 (released Jun 17, 2026, 90 days before disclosure).

    The latest release, 16.1.4, is not affected.

  • CVE-2026-62379Critical 9.8

    OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

    Affected: fixed in 16.1.2.

    Fixed in 16.1.2 (released Jul 20, 2026, 57 days before disclosure).

    The latest release, 16.1.4, is not affected.

  • OpenAM Insecure SSO Cookie Initialization

    Affected: fixed in 16.1.1.

    Fixed in 16.1.1 (released Jun 17, 2026, 90 days before disclosure).

    The latest release, 16.1.4, is not affected.

  • The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."

    Affected: fixed in 14.6.6.

    Fixed in 14.6.6 (released Jun 22, 2022, the day of disclosure).

    The latest release, 16.1.4, is not affected.