CVE-2026-46495 | | | 2026-09-15 | OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/Rm… |
CVE-2026-62379 | Critical | 9.8 | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XM… |
CVE-2026-62280 | Medium | 6.1 | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects r… |
CVE-2026-62263 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows… |
CVE-2026-53660 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie wit… |
CVE-2026-48717 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a code_verifier only when the rea… |
CVE-2026-47426 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the private_key_jwt client authentication path uses ClientJwksResolverCache… |
CVE-2026-47424 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author… |
CVE-2026-46623 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with prof… |
CVE-2026-46619 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the reques… |
CVE-2026-46498 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers from the shared Core… |
CVE-2026-45794 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource f… |
CVE-2026-45052 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenticated remote reques… |
CVE-2026-45051 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorImpl object graph fro… |
CVE-2026-45048 | High | 8.5 | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ow… |
CVE-2026-44793 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration incons… |
CVE-2026-44203 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficientl… |
CVE-2026-44202 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated use… |
CVE-2026-41573 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId parameter from /jso… |
CVE-2026-73644 | Critical | 9.6 | 2026-08-13 | OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/se… |
CVE-2026-33439 | Critical | 9.8 | 2026-04-07 | Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code… |
CVE-2025-64099 | | | 2025-11-12 | Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the "claims_parameter_supported" parameter is activated, it i… |
CVE-2025-27497 | | | 2025-03-05 | OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresp… |
CVE-2024-41667 | High | 8.8 | 2024-07-24 | OpenAM is an open access management solution. In versions 15.0.3 and prior, the `getCustomLoginUrlTemplate` method in RealmOAuth2ProviderSettings.java is vulne… |
CVE-2023-37471 | Critical | 9.1 | 2023-07-20 | Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Se… |
CVE-2022-34298 | Medium | 5.3 | 2022-06-23 | The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack." |