CVE-2026-105114
OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeated parameters to run JavaScript in the OpenAM origin, acting within existing sessions or redirecting to phishing pages.
| CWE | CWE-79 |
| Vendor | openidentityplatform |
| Product | openam |
| Published | Oct 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for openidentityplatform openam
Be the first to know when new medium vulnerabilities affecting openidentityplatform openam are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
OpenIdentityPlatform / OpenAM
0 < 16.1.3
References
Credits
🔍 Buggs777 tsujiguchitky