CVE-2026-45051 OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorImpl object graph from the configured userAttribute through loadAuthenticators without an ObjectInputFilter. Exploitation requires the WebAuthn flow to be...

CVE-2026-62263 OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

Open Access Management OpenAM is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows every serialized object at depth greater than 1 and therefore constrains only an AuthenticatorImpl root object. A pre-authentication attacke...

CVE-2026-46623 OpenAM Account Takeover via Unverified Password Change in OAuth2 Module

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with profile attributes that can include userPassword and inetUserStatus, rewriting the password to the username and reactivating disabled accounts...

CVE-2026-46623

OpenAM Community Edition (prior to 16.1.1) is vulnerable in its OAuth2 authentication module due to a missing OAuth.removeRestrictedAccountUpdateAttributes filter. On OAuth re-login of an existing account, profile attributes userPassword and inetUserStatus are written to the local account, silent...

CVE-2026-46619 OpenAM Authentication Bypass via MSISDN LDAP Injection

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a...

CVE-2026-46619 OpenAM Authentication Bypass via MSISDN LDAP Injection

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a...

CVE-2026-46619

OpenAM Community Edition (through 16.0.6) contains an LDAP injection (CWE-90) in the MSISDN authentication module . The request-supplied MSISDN value is concatenated into an LDAP search filter without escaping, and the default empty trusted-gateway list permits all traffic. An unauthenticated rem...

EUVD-2026-78360

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a...

CVE-2026-46619 OpenAM Authentication Bypass via MSISDN LDAP Injection

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a...

CVE-2026-46498 OpenAM Arbitrary OAuth Token Minting via Push Registration

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers from the shared Core Token Store CTS without an OAuth-only namespace, and OAuthAdapter accepts a row whose BLOB claims to contain an OAuth token without binding...

CVE-2026-45794

OpenAM Community Edition (through 16.0.6 ) is vulnerable to unsafe Java deserialization (CWE-502) in its Push Notification SNS callback resource (SnsMessageResource ). The route is mounted with anonymous access ; after a message ID expires from the in-memory dispatcher, it falls back to a CTS-sto...

CVE-2026-45794 OpenAM Unsafe Java Deserialization via SNS

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource falls back to a CTS predicate blob after a messageId expires from the in-memory dispatcher, treats top-level blob keys as Java class names fo...

CVE-2026-45048 OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session...

CVE-2026-45048

OpenAM Community Edition (through version 16.0.6) is affected by an insufficient authorization (CWE-285) and information exposure (CWE-200) flaw in the SessionRequestHandler within the session management endpoint. In deployments using stateful session storage , a low-privileged authenticated user...

EUVD-2026-78356

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the formpost response mode. An...

CVE-2026-44203 OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the formpost response mode. An...

CVE-2026-44203

OpenAM (Open Access Management), prior to version 16.1.1 , contains a pre-auth reflected XSS in the OAuth 2.0 / OpenID Connect authorization endpoint. The root cause is insufficient encoding of user-supplied parameters (notably the state parameter) before FormPostResponse.ftl and checkSession.ftl...

CVE-2026-44203 OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the formpost response mode. An...

CVE-2026-44203 OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the formpost response mode. An...

CVE-2026-44202

OpenAM (Open Identity Platform), an open-source IAM platform derived from ForgeRock, has an authenticated SSRF vulnerability in the /sessionservice addSessionListener operation. Prior to 16.1.1 , an authenticated user can register an arbitrary notification URL without requiring an administrative ...