CVE-2026-45052: Improper Authorization

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenticated remote requests to write persistent entries through SOAPReceiver and DiscoveryService into a user's Liberty Discovery store and the shared root-realm...

CVE-2026-41573: Improper Neutralization of Special Elements used in an LDAP Query

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection passes the queryId parameter from /json/realm/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches...

CVE-2026-44202: Server-Side Request Forgery (SSRF)

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. SessionRequestHandler passes th...

CVE-2026-47426: Improper Authentication

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the privatekeyjwt client authentication path uses ClientJwksResolverCache without reliably binding a cached jwksuri resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker...

CVE-2026-53660: Sensitive Cookie Without 'HttpOnly' Flag

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie with HttpOnly disabled and without a protective SameSite default, and OAuth and OpenID Connect consent flows reuse that cookie through...

CVE-2026-47424: Protection Mechanism Failure

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to escape the scripting sandbox despite the default class allow and deny lists. A user such as a sub-realm RealmAdmin who can create or edit...

CVE-2026-44203: Improper Neutralization of Input During Web Page Generation

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the formpost response mode. An...

CVE-2026-45794: Deserialization of Untrusted Data

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource falls back to a CTS predicate blob after a messageId expires from the in-memory dispatcher, treats top-level blob keys as Java class names fo...

CVE-2026-45051: Deserialization of Untrusted Data

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorImpl object graph from the configured userAttribute through loadAuthenticators without an ObjectInputFilter. Exploitation requires the WebAuthn flow to be...

CVE-2026-46623: Unverified Password Change

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with profile attributes that can include userPassword and inetUserStatus, rewriting the password to the username and reactivating disabled accounts...

CVE-2026-62280: Improper Neutralization of Input During Web Page Generation

Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an...

ForgeRock OpenAM <7.0 - Remote Code Execution

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...

Exploit for Deserialization of Untrusted Data in Openidentityplatform Openam

CVE-2026-33439 Python PoC Standalone Python proof of concept...

Insecure Default Initialization Of Resource

org.openidentityplatform.openam, openam-core is vulnerable to Insecure Default Initialization of Resource. The vulnerability is due to the default configuration setting the iPlanetDirectoryPro SSO cookie with HttpOnly=false while also using the cookie as a CSRF token in OAuth/OIDC flows, which...

OpenAM Insecure SSO Cookie Initialization

Summary Description An Insecure Default Initialization of Resource CWE-1188 issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community...

GHSA-FPMH-VX4H-XC33 OpenAM Insecure SSO Cookie Initialization

Summary Description An Insecure Default Initialization of Resource CWE-1188 issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community...

Sensitive Cookie with Improper SameSite Attribute

Overview Affected versions of this package are vulnerable to Sensitive Cookie with Improper SameSite Attribute through the server default configuration and OAuth2/OIDC consent flow in serverdefaults.properties, ConsentRequiredResource, and CsrfProtection. An attacker can steal or abuse an...

PT-2026-75964

Summary Description An Insecure Default Initialization of Resource CWE-1188 issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community...

PT-2026-76567

Summary Description An Insecure Default Initialization of Resource CWE-1188 issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community...

GHSA-WG5R-WC3X-39VC OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

Summary A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint /authservice, PLL accepts an XML element that names an arbitrary Java class, which the server then loads and instantiates without validation. On a default configuration this is...