---
id: "CVE-2026-44203"
kind: "vulnerability"
aliases: ["CVE-2026-44203", "GHSA-fq9h-c788-fx73"]
title: "OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)"
severity: "high"
cvss: 8.3
epss: 0.00593
exploited: false
status: "open"
category: "package"
products: [{"name": "org.openidentityplatform.openam:openam-oauth2", "fixed": ["16.1.1"], "affected": ">= 13.0.0, < 16.1.1", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["cwe-79", "java", "oauth2", "oidc", "openam", "package", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-06-22T20:11:49+00:00"
first_seen_at: "2026-10-28T15:29:41+00:00"
updated_at: "2026-10-28T15:33:37+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-fq9h-c788-fx73", "first_seen_at": "2026-10-28T15:29:41+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44203", "first_seen_at": "2026-10-28T15:33:37+00:00"}]
---

# OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

OpenAM's OAuth2/OIDC authorization endpoint reflects the state parameter unsanitized into the form_post HTML response (FormPostResponse.ftl). An attacker who lures a user to a crafted authorization URL can run script in the OpenAM origin.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.openidentityplatform.openam:openam-oauth2 affected >= 13.0.0, < 16.1.1 fixed 16.1.1

## How to check

- Check the openam-oauth2 Maven version in your build: `org.openidentityplatform.openam:openam-oauth2` below `16.1.1` is affected
- Check whether clients use `response_mode=form_post` on the authorization endpoint (unknown if the sources say more)

## Fix

- Upgrade openam-oauth2 to `16.1.1`
- Unknown whether a configuration workaround exists before upgrading

## Timeline

- 2026-10-28T15:29:41+00:00 ghsa https://github.com/advisories/GHSA-fq9h-c788-fx73
- 2026-10-28T15:33:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-44203

## From the sources

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the form_post response mode. An unauthenticated attacker can induce a user to open a crafted authorization request and execute script in the OpenAM origin. This issue is fixed in version 16.1.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_