Openidentityplatform vulnerabilities
54 CVEs and advisories name Openidentityplatform as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-48717OpenAM OAuth Authorization Bypass via PKCE Challenge
- CVE-2026-47426OpenAM OAuth Client Impersonation via JWKS Resolver Cache
- CVE-2026-47424OpenAM Authenticated RCE via Groovy Sandbox Escape
- CVE-2026-41573OpenAM LDAP Injection via `_queryId` Parameter
- CVE-2026-62280OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
- CVE-2026-45051OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage
- CVE-2026-62263OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
- CVE-2026-46623OpenAM Account Takeover via Unverified Password Change in OAuth2 Module
- CVE-2026-46619OpenAM Authentication Bypass via MSISDN LDAP Injection
- CVE-2026-46498OpenAM Arbitrary OAuth Token Minting via Push Registration
- CVE-2026-45794OpenAM Unsafe Java Deserialization via SNS
- CVE-2026-45048OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC
- CVE-2026-44203OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)
- CVE-2026-44202OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`
- CVE-2026-62379OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback
- CVE-2026-53660OpenAM Insecure SSO Cookie Initialization
- CVE-2026-45052OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints
- CVE-2026-44793OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`
- CVE-2026-73644OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grant
- CVE-2026-33439Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM
- CVE-2025-64099OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_info
- CVE-2025-27497OpenDJ Denial of Service (Dos) using alias loop
- CVE-2024-41667OpenAM FreeMarker template injection
- CVE-2023-37471User impersonation using SAMLv1.x SSO in Open Access Management