Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.openidentityplatform.openam:openam-federation-library

3 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
16.1.4 (Oct 22, 2026): no advisory affects it
Newest unaffected release
16.1.4 (Oct 22, 2026), the latest release
Advisories
3 · 2 critical, 1 high
Dependents
8
Releases
44 since 14.5.2 (Sep 15, 2020)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • CVE-2026-45052Critical 9.3

    OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

    Affected: fixed in 16.1.1.

    Fixed in 16.1.1 (released Jun 17, 2026, 90 days before disclosure).

    The latest release, 16.1.4, is not affected.

  • OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`

    Affected: fixed in 16.1.1.

    Fixed in 16.1.1 (released Jun 17, 2026, 90 days before disclosure).

    The latest release, 16.1.4, is not affected.

  • CVE-2023-37471Critical 9.1

    User impersonation using SAMLv1.x SSO in Open Access Management

    Affected: fixed in 14.7.3.

    Fixed in 14.7.3 (released Jul 20, 2023, the day of disclosure).

    The latest release, 16.1.4, is not affected.