Openidentityplatform vulnerabilities
54 CVEs and advisories name Openidentityplatform as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-123553OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login
- CVE-2026-123552OpenAM before 16.1.4 SSRF and CRL Tampering via Certificate CRL Distribution Point
- CVE-2026-123551OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket
- CVE-2026-123550OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions
- CVE-2026-123549OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass
- CVE-2026-123548OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages
- CVE-2026-123547OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState
- CVE-2026-123546OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFail
- CVE-2026-123545OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow
- CVE-2026-123544OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel
- CVE-2026-123543OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java Deserialisation
- CVE-2026-123542OpenAM before 16.1.4 PKCE Bypass in OAuth 2.0 Device Authorization Flow
- CVE-2026-123541OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching
- CVE-2026-123540OpenAM before 16.1.4 Incomplete Attribute Encoding in SAML 1.x Form POST
- CVE-2026-123539OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display Name
- CVE-2026-123538OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation
- CVE-2026-123537OpenAM before 16.1.4 SSRF via UMA Scope Description URLs
- CVE-2026-123536OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs
- CVE-2026-46560OpenAM Authentication Bypass via RADIUS Spoofing
- CVE-2026-45049OpenAM Session Hijacking via CDSSO
- CVE-2026-105122OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri
- CVE-2026-105121OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping
- CVE-2026-105120OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint
- CVE-2026-105119OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows
- CVE-2026-105118OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession
- CVE-2026-105117OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions
- CVE-2026-105116OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page
- CVE-2026-105115OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface
- CVE-2026-105114OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page
- CVE-2026-46495OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI