Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
44 results
Oct 3, 2026OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetcCVE-2026-105122 · Other software · OpenIdentityPlatform · reported by VulnCheckMedium 5.3
OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwks_uri. Attackers can trigger unauthenticated fetches through client-authentication and ID-token validation to probe internal hosts, metadata endpoints or local files, or exhaust request threads for denial of service.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 3, 2026OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realCVE-2026-105121 · Other software · OpenIdentityPlatform · reported by VulnCheckMedium 6.9
OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target session identifier or handle to forcibly log out users in any realm.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 3, 2026OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessiCVE-2026-105120 · Other software · OpenIdentityPlatform · reported by VulnCheckMedium 6.9
OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a _queryFilter naming another realm to disclose usernames, universal IDs, and session handles across tenant boundaries.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 3, 2026OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through OpCVE-2026-105119 · Other software · OpenIdentityPlatform · reported by VulnCheckHigh 7.6
OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through OpenID Connect hybrid flows (code token, code id_token, code token id_token) carry no bound challenge. An attacker who intercepts such a code can redeem it for a public client's tokens with any non-empty code_verifier.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 3, 2026OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint toCVE-2026-105118 · Other software · OpenIdentityPlatform · reported by VulnCheckLow 2.3
OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered post-logout URI, enabling phishing that borrows the OpenAM host's trust.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 3, 2026OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgoCVE-2026-105117 · Other software · OpenIdentityPlatform · reported by VulnCheckMedium 5.3
OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/{realm}/users. Attackers can supply subject and message fields to send phishing mail from the organisation's configured From address, or abuse register as a relay to arbitrary recipients.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 3, 2026OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cooCVE-2026-105116 · Other software · OpenIdentityPlatform · reported by VulnCheckMedium 5.1
OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce auto-submit page. If reachable with cookieHashRedirectEnabled set, crafted requests could execute script in the OpenAM origin, though an unrelated HTTP 500 failure prevents exploitation in released versions.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 3, 2026OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers tCVE-2026-105115 · Other software · OpenIdentityPlatform · reported by VulnCheckHigh 8.8
OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/* with an unverified session identifier and a chosen class name, crashing the server, probing the classpath, or potentially reaching code execution via gadget chains.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 3, 2026OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parametCVE-2026-105114 · Other software · OpenIdentityPlatform · reported by VulnCheckMedium 5.3
OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeated parameters to run JavaScript in the OpenAM origin, acting within existing sessions or redirecting to phishing pages.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-62379 · Other software · OpenIdentityPlatform · reported by GitHubCritical 9.8
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML element whose className value selects an arbitrary Java class for AuthXMLUtils to load and instantiate without verifying that it implements DSAMECallbackInterface. Default configurations expose the endpoint without authentication, allowing attacker-controlled class initialization and unsafe deserialization of a serialized Subject value to execute code in the server process. Enabling sunRemoteAuthSecurityEnabled does not prevent the vulnerable parsing and instantiation because its check occurs later. This issue is fixed in version 16.1.2.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-62280 · Other software · OpenIdentityPlatform · reported by GitHubMedium 6.1
Open Access Management (OpenAM) is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an active OpenAM session to follow a crafted authorization link and execute JavaScript in the OpenAM origin, enabling session or cookie theft, CSRF-token disclosure, and actions with the victim's privileges. At least one registered OAuth2 client is required, but the attacker does not need to control that client. This issue is fixed in version 16.1.2.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-62263 · Other software · OpenIdentityPlatform · reported by GitHubCritical 9.2
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows every serialized object at depth greater than 1 and therefore constrains only an AuthenticatorImpl root object. A pre-authentication attacker can supply a userHandle whose serialized graph has a valid AuthenticatorImpl root and a nested gadget class, causing readObject or readResolve execution before the cast and assertion verification when a usable gadget is on the classpath. This bypasses the incomplete remediation for the earlier WebAuthn deserialization vulnerability. This issue is fixed in version 16.1.2.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-53660 · Other software · OpenIdentityPlatform · reported by GitHubHigh 7.4
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie with HttpOnly disabled and without a protective SameSite default, and OAuth and OpenID Connect consent flows reuse that cookie through CsrfProtection as a CSRF token. When combined with same-origin cross-site scripting and a user following an attacker-controlled link, the cookie can be read and reused to steal the SSO session and complete attacker-driven consent grants. This issue is fixed in version 16.1.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-48717 · Other software · OpenIdentityPlatform · reported by GitHubCritical 9.1
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a code_verifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a code_challenge. Because that setting is disabled by default, an attacker who intercepts a PKCE-protected authorization code can omit code_verifier and redeem the code, while an explicitly incorrect verifier is rejected. Public clients are directly affected, and confidential-client exploitation additionally requires client authentication material or another redemption context. This issue is fixed in version 16.1.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-47426 · Other software · OpenIdentityPlatform · reported by GitHubHigh 7.6
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the private_key_jwt client authentication path uses ClientJwksResolverCache without reliably binding a cached jwks_uri resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker controlling any registered client with published keys, including one obtained through open dynamic registration when enabled, can authenticate as another client whose keys are exposed through jwks_uri and mint tokens in that client's name across realms in the same OpenAM process. This issue is fixed in version 16.1.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-47424 · Other software · OpenIdentityPlatform · reported by GitHubHigh 7.5
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to escape the scripting sandbox despite the default class allow and deny lists. A user such as a sub-realm RealmAdmin who can create or edit a script in an executed context can invoke operating-system commands as the OpenAM application server account, crossing the realm-scoped administration boundary and compromising the JVM and every realm it serves. This issue is fixed in version 16.1.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-46623 · Other software · OpenIdentityPlatform · reported by GitHubHigh 7.4
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with profile attributes that can include userPassword and inetUserStatus, rewriting the password to the username and reactivating disabled accounts. The missing OAuth.removeRestrictedAccountUpdateAttributes filtering permits these credential and status fields to reach the account update. With account creation enabled, repeated OAuth login causes the default ldapService chain to accept the username as both identifier and password, allowing an unauthenticated attacker to take over the local account without interacting with the identity provider. The rewrite can be denied for usernames shorter than the configured minimum password length. This issue is fixed in version 16.1.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-46619 · Other software · OpenIdentityPlatform · reported by GitHubCritical 9.3
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a realm where an MSISDN module is enabled in a reachable authentication chain, an unauthenticated remote attacker can inject LDAP filter metacharacters, select an arbitrary matching user, and obtain a normal authenticated OpenAM session without a password. This issue is fixed in version 16.1.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-46498 · Other software · OpenIdentityPlatform · reported by GitHubHigh 7.6
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers from the shared Core Token Store (CTS) without an OAuth-only namespace, and OAuthAdapter accepts a row whose BLOB claims to contain an OAuth token without binding the trusted CTS type or verifying integrity. An attacker who can place controlled JSON in CTS under a known token identifier, such as through Push Registration followed by an anonymous SNS callback in an enabled realm, can mint OAuth bearer tokens and OpenID Connect ID tokens with chosen subject, client, realm, and scope. The flaw does not by itself create an OpenAM SSO session or grant console access. This issue is fixed in version 16.1.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-45794 · Other software · OpenIdentityPlatform · reported by GitHubHigh 7.7
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource falls back to a CTS predicate blob after a messageId expires from the in-memory dispatcher, treats top-level blob keys as Java class names for Class.forName, and deserializes attacker-controlled JSON through Jackson. A low-privileged user who starts Push Registration and obtains the messageId, shared secret, and challenge can wait for expiry, replace the persistent blob through anonymous callbacks, and trigger class loading and construction in the OpenAM JVM. The primitive can cause classpath-dependent process execution, file writes, or denial of service, although command execution was not confirmed on the tested stock classpath. This issue is fixed in version 16.1.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-45052 · Other software · OpenIdentityPlatform · reported by GitHubCritical 9.3
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenticated remote requests to write persistent entries through SOAPReceiver and DiscoveryService into a user's Liberty Discovery store and the shared root-realm Discovery branch. The server-side handlers bypass requester LDAP and identity ACLs, and the global path uses an internal administrative token. Deployments that consume Liberty discovery data can subsequently use manipulated service-routing or security-mechanism records. This issue is fixed in version 16.1.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-45051 · Other software · OpenIdentityPlatform · reported by GitHubCritical 9.2
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorImpl object graph from the configured userAttribute through loadAuthenticators without an ObjectInputFilter. Exploitation requires the WebAuthn flow to be reachable and an attacker to have previously written controlled data to that attribute through delegated administration, provisioning, directory access, legacy REST self-registration, or unsafe configuration. When those non-default conditions hold, the data is deserialized before assertion verification and can execute a classpath gadget in the application server process. This issue is fixed in version 16.1.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-45048 · Other software · OpenIdentityPlatform · reported by GitHubHigh 8.5
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session storage. A requester who knows a target identity identifier can retrieve another user's active session credentials, including credentials for a more privileged account, and use them to hijack that session. This issue is fixed in version 16.1.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-44793 · Other software · OpenIdentityPlatform · reported by GitHubHigh 7
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can induce a user to follow a crafted request and execute script in the OpenAM origin. This issue is fixed in version 16.1.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-44203 · Other software · OpenIdentityPlatform · reported by GitHubHigh 8.3
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the form_post response mode. An unauthenticated attacker can induce a user to open a crafted authorization request and execute script in the OpenAM origin. This issue is fixed in version 16.1.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-44202 · Other software · OpenIdentityPlatform · reported by GitHubMedium 5.3
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. SessionRequestHandler passes the attacker-controlled destination to the session listener service, causing the OpenAM server to make outbound requests and potentially disclose session-related notification data to an attacker-controlled destination. This issue is fixed in version 16.1.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-41573 · Other software · OpenIdentityPlatform · reported by GitHubHigh 7.1
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId parameter from /json/{realm}/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches DJLDAPv3Repo.getFilter(), where it is concatenated into an LDAP filter, allowing an authenticated attacker to inject LDAP metacharacters for user enumeration and blind LDAP injection. This issue is fixed in version 16.1.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2026OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing.CVE-2026-37540 · Other software · Linaro · reported by MITREHigh 8.4
OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing. In elf_loader.c, it performs multiplication of two attacker-controlled 16-bit values from the ELF header without overflow checking. On 32-bit embedded systems (STM32MP1, Zynq, i.MX), large values can cause the product to wrap around to a small value.
- Product
- Openamp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 7, 2026Open Access Management (OpenAM) is an access management solution.CVE-2026-33439 · Other software · OpenIdentityPlatform · reported by GitHubCritical 9.3
Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025Open Access Management (OpenAM) is an access management solution.CVE-2025-64099 · Other software · OpenIdentityPlatform · reported by GitHubHigh 8.1
Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the "claims_parameter_supported" parameter is activated, it is possible, thanks to the "oidc-claims-extension.groovy" script, to inject the value of one's choice into a claim contained in the id_token or in the user_info. In the request of an authorize function, a claims parameter containing a JSON file can be injected. This JSON file allows attackers to customize the claims returned by the "id_token" and "user_info" files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, an attacker can choose the email address they want, and therefore assume any identity they choose. Version 16.0.0 fixes the issue.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025OpenAM (OpenAM Consortium Edition) contains a vulnerability that may cause it to malfunction as a SAML IdP due to a tampered request.This issue affects OpenAM: CVE-2025-8662 · Other software · OpenAM consortium · reported by 37c6977f-aa3f-41e8-829b-3e8ff4df3c14Low 2.3
OpenAM (OpenAM Consortium Edition) contains a vulnerability that may cause it to malfunction as a SAML IdP due to a tampered request.This issue affects OpenAM: from 14.0.0 through 14.0.1.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2024OpenAM is an open access management solution.CVE-2024-41667 · Other software · OpenIdentityPlatform · reported by GitHubHigh 8.8
OpenAM is an open access management solution. In versions 15.0.3 and prior, the `getCustomLoginUrlTemplate` method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to override the default OpenAM login, they did not restrict the `CustomLoginUrlTemplate`, allowing it to be set freely. Commit fcb8432aa77d5b2e147624fe954cb150c568e0b8 introduces `TemplateClassResolver.SAFER_RESOLVER` to disable the resolution of commonly exploited classes in FreeMarker template injection. As of time of publication, this fix is expected to be part of version 15.0.4.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2023Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services SecCVE-2023-37471 · Other software · OpenIdentityPlatform · reported by GitHubCritical 9.1
Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the SAMLPOSTProfileServlet servlet. This problem has been patched in OpenAM 14.7.3-SNAPSHOT and later. User unable to upgrade should comment servlet `SAMLPOSTProfileServlet` from their pom file. See the linked GHSA for details.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2023OpenAM Web Policy Agent (OpenAM Consortium Edition) provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerability(CWE-22).CVE-2023-22320 · Other software · OpenAM consortium · reported by vultures@jpcert.or.jpHigh 7.5
OpenAM Web Policy Agent (OpenAM Consortium Edition) provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerability(CWE-22). Furthermore, a crafted URL may be evaluated incorrectly.
- Product
- OpenAM Web Policy Agent (OpenAM Consortium Edition)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022OpenAM Consortium Edition version 14.0.0 provided by OpenAM Consortium contains an open redirect vulnerability (CWE-601).CVE-2022-31735 · Other software · OpenAM consortium · reported by vultures@jpcert.or.jpMedium 6.1
OpenAM Consortium Edition version 14.0.0 provided by OpenAM Consortium contains an open redirect vulnerability (CWE-601). When accessing an affected server through some specially crafted URL, the user may be redirected to an arbitrary website.
- Product
- OpenAM (OpenAM Consortium Edition)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."CVE-2022-34298 · Other software · Openidentityplatform · reported by MITREMedium 5.3
The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."
- Product
- Openam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2021ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol.CVE-2021-29156 · Other software · Forgerock · reported by MITREHigh 7.5
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.
- Product
- Openam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugster.forgerock.orgportswigger.net
Jun 19, 2019Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_CVE-2017-14395 · Other software · Forgerock · reported by MITREMedium 6.1
Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to execute a script in the user's browser via reflected XSS.
- Product
- Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbackstage.forgerock.combackstage.forgerock.com
Jun 19, 2019OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirectCVE-2017-14394 · Other software · Forgerock · reported by MITREMedium 6.1
OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to perform phishing via an unvalidated redirect.
- Product
- Access Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbackstage.forgerock.combackstage.forgerock.com
Feb 13, 2019Open redirect vulnerability in OpenAM (Open Source Edition) 13.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks vCVE-2019-5915 · Other software · OpenAM Consortium · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in OpenAM (Open Source Edition) 13.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page.
- Product
- OpenAM (Open Source Edition)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpcs.themistruct.com
Feb 13, 2019OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and CVE-2018-0696 · Other software · OpenAM Consortium · reported by vultures@jpcert.or.jpHigh 7.5
OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpcs.themistruct.com
Nov 2, 2017OpenAM (Open Source Edition) allows an attacker to bypass authentication and access unauthorized contents via unspecified vectors.CVE-2017-10873 · Other software · Open Source Solution Technology Corporation · reported by vultures@jpcert.or.jpHigh 8.1
OpenAM (Open Source Edition) allows an attacker to bypass authentication and access unauthorized contents via unspecified vectors. Note that this vulnerability affects OpenAM (Open Source Edition) implementations configured as SAML 2.0IdP, and switches authentication methods based on AuthnContext requests sent from the service provider.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpcs.themistruct.com
Jan 2, 2017XML External Entity (XXE) Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote attackers to read arbitrary filesCVE-2016-10097 · Other software · Forgerock · reported by MITREHigh 7.5
XML External Entity (XXE) Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote attackers to read arbitrary files via the SAMLRequest parameter.
- Product
- Openam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcloudscan.mesecurityfocus.com
Nov 13, 2014The Core Server in OpenAM 9.5.3 through 9.5.5, 10.0.0 through 10.0.2, 10.1.0-Xpress, and 11.0.0 through 11.0.2, when deployed on a multi-server network, allows CVE-2014-7246 · Other software · Forgerock · reported by vultures@jpcert.or.jpLow 3.5
The Core Server in OpenAM 9.5.3 through 9.5.5, 10.0.0 through 10.0.2, 10.1.0-Xpress, and 11.0.0 through 11.0.2, when deployed on a multi-server network, allows remote authenticated users to cause a denial of service (infinite loop) via a crafted cookie in a request.
- Product
- Openam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.