OpenIdentityPlatform vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20241
3. 20252
4. 202632

Newest CVEs

• CVE-2026-46560

  OpenAM Authentication Bypass via RADIUS Spoofing

  OpenIdentityPlatform · OpenAM

  High7.5
• CVE-2026-45049

  OpenAM Session Hijacking via CDSSO

  OpenIdentityPlatform · OpenAM

  High8.3
• CVE-2026-105122

  OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri

  OpenIdentityPlatform · OpenAM

  Medium5.3
• CVE-2026-105121

  OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping

  OpenIdentityPlatform · OpenAM

  Medium6.9
• CVE-2026-105120

  OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint

  OpenIdentityPlatform · OpenAM

  Medium6.9
• CVE-2026-105119

  OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows

  OpenIdentityPlatform · OpenAM

  High7.6
• CVE-2026-105118

  OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession

  OpenIdentityPlatform · OpenAM

  Low2.3
• CVE-2026-105117

  OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions

  OpenIdentityPlatform · OpenAM

  Medium5.3
• CVE-2026-105116

  OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page

  OpenIdentityPlatform · OpenAM

  Medium5.1
• CVE-2026-105115

  OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

  OpenIdentityPlatform · OpenAM

  High8.8