Live › vulnerability › CVE-2026-44793
Go to dashboardThe OpenAM federation library renders some user-supplied parameters into HTML responses without consistent output encoding on certain federation endpoints. In a non-default clustered SAML2 setup, an attacker can inject script into the OpenAM origin without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 15:29 UTC, 0h before NVD. All times on this page are UTC.
Deployments running OpenAM with the federation library below that use the SAML2 cluster cookie-hash redirect path, which the advisory describes as a non-default configuration used in some clustered deployments. Single-node or non-clustered installs without that configuration are less likely to be exposed; the sources do not say more precisely.
16.1.1| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.openidentityplatform.openam:openam-federation-library | maven | < 16.1.1 | 16.1.1 |
org.openidentityplatform.openam:openam-federation-library in your Maven dependency tree (mvn dependency:tree | grep openam-federation-library).openam-federation-library to 16.1.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can induce a user to follow a crafted request and execute script in the OpenAM origin. This issue is fixed in version 16.1.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-44793")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.