Live › vulnerability › CVE-2026-44203
Go to dashboardOpenAM's OAuth2/OIDC authorization endpoint reflects the state parameter unsanitized into the form_post HTML response (FormPostResponse.ftl). An attacker who lures a user to a crafted authorization URL can run script in the OpenAM origin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 15:29 UTC, 0h before NVD. All times on this page are UTC.
Deployments running OpenAM OAuth2/OIDC with versions from 13.0.0 up to but not including 16.1.1. The sources tie the flaw to the form_post response mode, so deployments that never use that mode are likely less exposed, but the sources do not confirm this. Unknown whether managed hosting is affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.openidentityplatform.openam:openam-oauth2 | maven | >= 13.0.0, < 16.1.1 | 16.1.1 |
org.openidentityplatform.openam:openam-oauth2 below 16.1.1 is affectedresponse_mode=form_post on the authorization endpoint (unknown if the sources say more)16.1.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the form_post response mode. An unauthenticated attacker can induce a user to open a crafted authorization request and execute script in the OpenAM origin. This issue is fixed in version 16.1.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-44203")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.