- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 7 · 1 critical, 5 high, 1 medium
- Dependents
- 0
- Registry
- Maven Central
Advisories 7
- CVE-2026-48717Critical 9.1
OpenAM OAuth Authorization Bypass via PKCE Challenge
Affected: fixed in 16.1.1.
- CVE-2026-47426High 7.6
OpenAM OAuth Client Impersonation via JWKS Resolver Cache
Affected: fixed in 16.1.1.
- CVE-2026-62280Medium 6.1
OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
Affected: from 13.0.0, fixed in 16.1.2.
- CVE-2026-46498High 7.6
OpenAM Arbitrary OAuth Token Minting via Push Registration
Affected: fixed in 16.1.1.
- CVE-2026-44203High 8.3
OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)
Affected: from 13.0.0, fixed in 16.1.1.
- CVE-2025-64099High 8.1
OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_info
Affected: fixed in 16.0.3.
- CVE-2024-41667High 8.8
OpenAM FreeMarker template injection
Affected: fixed in 15.0.4.