{"id":"CVE-2026-44203","kind":"vulnerability","aliases":["CVE-2026-44203","GHSA-fq9h-c788-fx73"],"related":[],"title":"OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)","description":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the form_post response mode. An unauthenticated attacker can induce a user to open a crafted authorization request and execute script in the OpenAM origin. This issue is fixed in version 16.1.1.","summary":"OpenAM's OAuth2/OIDC authorization endpoint reflects the state parameter unsanitized into the form_post HTML response (FormPostResponse.ftl). An attacker who lures a user to a crafted authorization URL can run script in the OpenAM origin.","severity":"high","cvss":8.3,"epss":0.00593,"exploited":false,"exploited_at":null,"products":[{"name":"org.openidentityplatform.openam:openam-oauth2","fixed":["16.1.1"],"affected":">= 13.0.0, < 16.1.1","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["cwe-79","java","oauth2","oidc","openam","package","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the openam-oauth2 Maven version in your build: `org.openidentityplatform.openam:openam-oauth2` below `16.1.1` is affected\n- Check whether clients use `response_mode=form_post` on the authorization endpoint (unknown if the sources say more)","fix":"- Upgrade openam-oauth2 to `16.1.1`\n- Unknown whether a configuration workaround exists before upgrading","status":"open","published_at":"2026-06-22T20:11:49+00:00","first_seen_at":"2026-10-28T15:29:41+00:00","triaged_at":"2026-10-28T15:30:59+00:00","updated_at":"2026-10-28T15:33:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T15:30:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade openam-oauth2 to `16.1.1`\n- Unknown whether a configuration workaround exists before upgrading","reach":"internet","title":"OpenAM: pre-auth reflected XSS in OAuth2 form_post response mode","impact":"medium","summary":"OpenAM's OAuth2/OIDC authorization endpoint reflects the state parameter unsanitized into the form_post HTML response (FormPostResponse.ftl). An attacker who lures a user to a crafted authorization URL can run script in the OpenAM origin.","category":"package","nicknames":[],"who_cares":["openam","oauth2","oidc","self-hosted","java"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker script runs in the OpenAM origin, stealing sessions","analyst_note":"Confirm whether form_post is enabled by default and whether a workaround exists before 16.1.1; check https://github.com/advisories/GHSA-fq9h-c788-fx73 for details.","how_to_check":"- Check the openam-oauth2 Maven version in your build: `org.openidentityplatform.openam:openam-oauth2` below `16.1.1` is affected\n- Check whether clients use `response_mode=form_post` on the authorization endpoint (unknown if the sources say more)","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Deployments running OpenAM OAuth2/OIDC with versions from 13.0.0 up to but not including 16.1.1. The sources tie the flaw to the form_post response mode, so deployments that never use that mode are likely less exposed, but the sources do not confirm this. Unknown whether managed hosting is affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":3412,"output_tokens":631,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':20A,28A '-44203':21A,29A '-79':35B '16.1.1':90C,147C '2.0':93C 'access':80C,85C 'attack':62B,123C 'auth':5A 'author':47B,70B,97C,132C 'c788':25A 'checksession.ftl':110C 'connect':96C 'craft':69B,131C 'cve':19A,27A 'cwe':34B 'encod':102C 'endpoint':48B,98C 'execut':135C 'fix':144C 'form':13A,56B,117C 'formpostresponse.ftl':18A,60B,108C 'fq9h':24A 'fx73':26A 'ghsa':23A 'ghsa-fq9h-c788-fx73':22A 'host':43B 'html':58B,114C 'induc':125C 'issu':142C 'java':36B 'lure':64B 'manag':81C,86C 'mode':12A,120C 'oauth':92C 'oauth2':9A,33A,37B 'oauth2/oidc':46B 'oidc':10A,38B 'open':79C,129C 'openam':1A,32A,39B,44B,77B,82C,139C 'openam-oauth2':31A 'openid':95C 'org.openidentityplatform.openam':30A 'origin':78B,140C 'packag':40B 'paramet':17A,52B,106C 'post':14A,57B,118C 'pre':4A 'pre-auth':3A 'prior':88C 'reflect':6A,49B 'render':111C 'request':133C 'respons':11A,59B,119C 'run':73B 'script':74B,136C 'self':42B 'self-host':41B 'solut':87C 'state':16A,51B 'suffici':101C 'suppli':105C 'unauthent':122C 'unsanit':53B 'url':71B 'user':66B,104C,127C 'user-suppli':103C 'version':146C 'via':15A 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Deployments running OpenAM OAuth2/OIDC with versions from 13.0.0 up to but not including 16.1.1. The sources tie the flaw to the form_post response mode, so deployments that never use that mode are likely less exposed, but the sources do not confirm this. Unknown whether managed hosting is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-22T20:11:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-fq9h-c788-fx73","url":"https://github.com/advisories/GHSA-fq9h-c788-fx73","severity":"high","published_at":"2026-06-22T20:11:49+00:00","modified_at":"2026-10-28T15:28:39+00:00","first_seen_at":"2026-10-28T15:29:41+00:00","fetched_at":"2026-10-28T15:29:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-44203","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44203","severity":null,"published_at":"2026-09-15T10:17:03+00:00","modified_at":"2026-09-23T18:19:19+00:00","first_seen_at":"2026-10-28T15:33:37+00:00","fetched_at":"2026-10-28T15:33:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}