Product by OpenIdentityPlatform

    OpenIdentityPlatform OpenAM

    34 known vulnerabilities in OpenIdentityPlatform OpenAM (OpenIdentityPlatform), 0 of them actively exploited (CISA KEV).

    Key figures

    34

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    8

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in OpenIdentityPlatform OpenAM (OpenIdentityPlatform)
    CriticalCVE-2026-33439

    Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

    		9.8
    HighCVE-2024-41667

    OpenAM FreeMarker template injection

    		8.8
    CriticalCVE-2026-62379

    OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

    		9.8
    CriticalCVE-2026-46619

    OpenAM Authentication Bypass via MSISDN LDAP Injection

    		—
    CriticalCVE-2026-62263

    OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

    		—
    CriticalCVE-2026-45052

    OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

    		—
    CriticalCVE-2026-45051

    OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

    		—
    MediumCVE-2022-34298

    OpenIdentityPlatform OpenAM: security vulnerability

    		5.3
    CriticalCVE-2026-48717

    OpenAM OAuth Authorization Bypass via PKCE Challenge

    		—
    CriticalCVE-2023-37471

    User impersonation using SAMLv1.x SSO in Open Access Management

    		9.1
    HighCVE-2026-44203

    OpenIdentityPlatform OpenAM: Cross-site Scripting

    		—
    HighCVE-2026-105115

    OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

    		8.6
    HighCVE-2026-45794

    OpenAM Unsafe Java Deserialization via SNS

    		—
    HighCVE-2026-46623

    OpenAM Account Takeover via Unverified Password Change in OAuth2 Module

    		—
    HighCVE-2026-47426

    OpenAM OAuth Client Impersonation via JWKS Resolver Cache

    		—
    HighCVE-2026-44793

    OpenIdentityPlatform OpenAM: Cross-site Scripting

    		—
    HighCVE-2026-45048

    OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC

    		8.5
    HighCVE-2026-47424

    OpenAM Authenticated RCE via Groovy Sandbox Escape

    		—
    HighCVE-2026-45049

    OpenAM Session Hijacking via CDSSO

    		8.3
    HighCVE-2026-41573

    OpenAM LDAP Injection via `_queryId` Parameter

    		—
    HighCVE-2026-46498

    OpenAM Arbitrary OAuth Token Minting via Push Registration

    		—
    HighCVE-2026-53660

    OpenAM Insecure SSO Cookie Initialization

    		—
    HighCVE-2026-46560

    OpenAM Authentication Bypass via RADIUS Spoofing

    		7.5
    HighCVE-2026-105119

    OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows

    		6.8
    MediumCVE-2026-105120

    OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint

    		4.9

    All vulnerabilities in search

    All products by OpenIdentityPlatform