CVE-2026-105116GHSA-v796-mg6j-9c5m
OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page
OpenIdentityPlatform OpenAM
CVSS
5.1MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 16.1.3OpenAMCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce auto-submit page. If reachable with cookieHashRedirectEnabled set, crafted requests could execute script in the OpenAM origin, though an unrelated HTTP 500 failure prevents exploitation in released versions.
Text from CVE List
Affected versions 2
- OpenAMaffected: all versions before 16.1.3CVE List
- OpenAMunaffected: 16.1.3CVE List