All vulnerabilities
CVE-2026-44203GHSA-fq9h-c788-fx73

OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

OpenIdentityPlatform org.openidentityplatform.openam:openam-oauth2mavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.59%Chance of exploitation activity in the next 30 days, higher than 48% of CVEs. Scored 28 Oct 2026FIRST EPSS
Fixed in16.1.1Fixed versionGitHub
Published15 Sep 2026Updated 28 Oct 2026CVE List

What fixes it

  • 16.1.1org.openidentityplatform.openam:openam-oauth2, mavenGitHub<dependency><groupId>org.openidentityplatform.openam</groupId><artifactId>openam-oauth2</artifactId><version>16.1.1</version></dependency>
  • 16.1.1org.openidentityplatform.openam:openam-oauth2, MavenOSV<dependency><groupId>org.openidentityplatform.openam</groupId><artifactId>openam-oauth2</artifactId><version>16.1.1</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

The OAuth 2.0 / OpenID Connect authorization endpoint does not sufficiently sanitize certain user-supplied parameters before incorporating them into the HTML response generated for the form_post response mode. This may allow an attacker to inject content into the rendered page in the context of the OpenAM origin.

Text from GitHub Advisory Database

Affected versions 43

  • org.openidentityplatform.openam:openam-oauth2, maven>= 13.0.0, < 16.1.1GitHub
  • OpenAMaffected: < 16.1.1CVE List
  • org.openidentityplatform.openam:openam-oauth2, Mavenfrom 13.0.0, fixed in 16.1.1OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.5.2OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.5.3OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.5.4OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.6.1OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.6.2OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.6.3OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.6.4OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.6.5OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.6.6OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.7.0OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.7.1OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.7.2OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.7.3OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.7.4OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.8.1OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.8.2OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.8.3OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.8.4OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.0.0OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.0.1OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.0.2OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.0.3OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.0.4OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.1.0OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.1.1OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.1.2OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.1.3OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.1.4OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.1.5OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.1.6OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.2.0OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.2.1OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.2.2OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven16.0.1OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven16.0.2OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven16.0.3OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven16.0.4OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven16.0.5OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven16.0.6OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven16.1.0OSV

References 5