CVE-2026-123539 · Other
NO FIX YET · SEE WHAT TO DO
OpenAM before 16.1.4 does not encode a user's display name on the OAuth 2.0 / OpenID Connect consent page. A privileged attacker who sets markup as a display name can run script in a victim's browser that steals the OpenAM session cookie and impersonates that user.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running OpenAM before 16.1.4 that use the OAuth 2.0 / OpenID Connect consent page. The attacker must be a privileged user who can set display names, and the victim must open the consent page. unknown whether other configurations are affected.
Not affected if no-privileged-user-risk, openam-16.1.4-or-later
Who cares oauth, openam, openid-connect, self-hosted
16.1.4 are in the affected range.16.1.4 or later, per the sources.OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that allows privileged attackers to inject script by placing markup in a user's display name. When the victim reaches the OAuth 2.0 / OpenID Connect consent page, the unencoded name executes script that can steal the OpenAM session cookie to impersonate the user.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.