CVE-2026-105114

OpenAM versions prior to 16.1.3 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The root cause is the lack of encoding for crafted parameters rendered on the OAuth2 authorization error page . Unauthenticated attackers can leverage this by tricking victims into clicking a s...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

EUVD-2026-92018

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114: Improper Neutralization of Input During Web Page Generation

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

PT-2026-104580

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description The OAuth2 Provider PKCE enforcement is only applied to authorization requests where the response type is exactly code. Consequently, codes issued via OpenID Connect hybrid flows such as code token,...

CVE-2026-105118: Improper Verification of Cryptographic Signature

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified idtokenhint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered...

PT-2026-104575

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An issue exists where unauthenticated attackers can perform reflected cross-site scripting XSS by providing crafted parameters that are rendered without proper encoding on the OAuth2 authorization...

CVE-2026-105119: Improper Authorization

OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose responsetype is exactly code, so codes issued through OpenID Connect hybrid flows code token, code idtoken, code token idtoken carry no bound challenge. An attacker who intercepts such a code ca...

PT-2026-104579

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An open redirect issue exists where unauthenticated attackers can redirect users by providing an unverified id token hint to the '/oauth2/connect/endSession' endpoint. By specifying any realm client ...

CVE-2026-66071

A flaw was found in rabbitmq-server where its OAuth2 authentication backend improperly converts token scope values into Erlang runtime atoms. In deployments where an Identity Provider IdP allows users to influence scope contents within their signed JSON Web Tokens JWTs, an authenticated attacker...

CVE-2026-103957

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

EUVD-2026-91772

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2026-103957

A Server-side request forgery (SSRF) vulnerability exists in the OAuth2 discovery handling of Loom for AWS versions prior to 1.7.0 . An authenticated remote user can exploit this by supplying a crafted discovery document address when registering a tool server or remote agent configured for delega...

CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

Exploit for CVE-2026-103752

CVE-2026-103752: Unauthenticated Privilege Escalation in WordP...

PT-2026-104418

Name of the Vulnerable Software and Affected Versions Loom for AWS versions prior to 1.7.0 Description An authenticated remote user can perform a Server-side request forgery SSRF through the OAuth2 discovery handling. By providing a crafted discovery document address during the registration of a...

CVE-2026-103957: Server-Side Request Forgery (SSRF)

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...