OpenAM
- Software type
- Identity and access management
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/20/2026, OpenAM recorded 27 security vulnerabilities in the last 90 days, of which 18 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of OpenAM and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-105122OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uriCVE-2026-105121OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm ScopingCVE-2026-105120OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST EndpointCVE-2026-105119OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid FlowsCVE-2026-105118OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-105122OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-105121OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping | Exploitation statusNot exploited | FixYes | Published10/03/2026 | SeverityMedium |
|---|
CVE-2026-105120OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint | Exploitation statusNot exploited | FixYes | Published10/03/2026 | SeverityMedium |
|---|
CVE-2026-105119OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows | Exploitation statusNot exploited | FixYes | Published10/03/2026 | SeverityHigh |
|---|
CVE-2026-105118OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession | Exploitation statusNot exploited | FixYes | Published10/03/2026 | SeverityLow |
|---|
CVE-2026-105117OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions | Exploitation statusNot exploited | FixYes | Published10/03/2026 | SeverityMedium |
|---|
CVE-2026-105116OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page | Exploitation statusNot exploited | FixYes | Published10/03/2026 | SeverityMedium |
|---|
CVE-2026-105115OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface | Exploitation statusNot exploited | FixYes | Published10/03/2026 | SeverityHigh |
|---|
CVE-2026-105114OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page | Exploitation statusNot exploited | FixYes | Published10/03/2026 | SeverityMedium |
|---|
CVE-2026-48717OpenAM OAuth Authorization Bypass via PKCE Challenge | Exploitation statusNot exploited | FixYes | Published09/15/2026 | SeverityCritical |
|---|
32 Results | Page 1 of 4