CVE-2026-105119

OpenAM versions prior to 16.1.3 are vulnerable to a PKCE enforcement bypass via OAuth 2.0 hybrid flows . The root cause is that the software only applies Proof Key for Code Exchange (PKCE) enforcement to authorization requests where the response_type is exactly code. Consequently, codes issued th...

CVE-2026-105118 OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified idtokenhint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered...

EUVD-2026-92023

OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose responsetype is exactly code, so codes issued through OpenID Connect hybrid flows code token, code idtoken, code token idtoken carry no bound challenge. An attacker who intercepts such a code ca...

EUVD-2026-92022

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified idtokenhint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered...

CVE-2026-105118 OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified idtokenhint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

EUVD-2026-92018

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114

OpenAM versions prior to 16.1.3 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The root cause is the lack of encoding for crafted parameters rendered on the OAuth2 authorization error page . Unauthenticated attackers can leverage this by tricking victims into clicking a s...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

OAUTHScan

OAUTHScan Description OAUTHScan is a Burp Suite Extension written in Java with the aim to provide some automatic security checks, which could be useful during penetration testing on applications implementing OAUTHv2 and OpenID standards. The plugin looks for various OAUTHv2/OpenID vulnerabilities...

CVE-2026-105119: Improper Authorization

OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose responsetype is exactly code, so codes issued through OpenID Connect hybrid flows code token, code idtoken, code token idtoken carry no bound challenge. An attacker who intercepts such a code ca...

CVE-2026-105118: Improper Verification of Cryptographic Signature

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified idtokenhint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered...

PT-2026-104575

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An issue exists where unauthenticated attackers can perform reflected cross-site scripting XSS by providing crafted parameters that are rendered without proper encoding on the OAuth2 authorization...

CVE-2026-105114: Improper Neutralization of Input During Web Page Generation

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

PT-2026-104579

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An open redirect issue exists where unauthenticated attackers can redirect users by providing an unverified id token hint to the '/oauth2/connect/endSession' endpoint. By specifying any realm client ...

PT-2026-104580

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description The OAuth2 Provider PKCE enforcement is only applied to authorization requests where the response type is exactly code. Consequently, codes issued via OpenID Connect hybrid flows such as code token,...

CVE-2026-66071

A flaw was found in rabbitmq-server where its OAuth2 authentication backend improperly converts token scope values into Erlang runtime atoms. In deployments where an Identity Provider IdP allows users to influence scope contents within their signed JSON Web Tokens JWTs, an authenticated attacker...

CVE-2026-103957

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...

CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted...