Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-105114

OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeated parameters to run JavaScript in the OpenAM origin, acting within existing sessions or redirecting to phishing pages.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenIdentityPlatform OpenAM

Default version status: unaffected

  • 0 to < 16.1.3affected
  • 16.1.3unaffected
pkg:maven/org.openidentityplatform.openam/openam-oauth2

References