CVE-2026-46560 | High | 7.5 | 2026-10-30 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module opens an unconnected datagram socket and… |
CVE-2026-45049 | High | 8.3 | 2026-10-29 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user'… |
CVE-2026-105122 | Medium | 5.4 | 2026-10-03 | OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fet… |
CVE-2026-105121 | Medium | 4.9 | 2026-10-03 | OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because rea… |
CVE-2026-105120 | Medium | 4.9 | 2026-10-03 | OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sess… |
CVE-2026-105119 | Medium | 6.8 | 2026-10-03 | OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through O… |
CVE-2026-105118 | Medium | 4.7 | 2026-10-03 | OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint t… |
CVE-2026-105117 | Medium | 6.1 | 2026-10-03 | OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forg… |
CVE-2026-105116 | Medium | 6.1 | 2026-10-03 | OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer co… |
CVE-2026-105115 | High | 8.6 | 2026-10-03 | OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers… |
CVE-2026-105114 | Medium | 6.1 | 2026-10-03 | OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parame… |
CVE-2026-46495 | | | 2026-09-15 | OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/Rm… |
CVE-2026-62379 | Critical | 9.8 | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XM… |
CVE-2026-62280 | Medium | 6.1 | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects r… |
CVE-2026-62263 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInputFilter that allows… |
CVE-2026-53660 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie wit… |
CVE-2026-48717 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a code_verifier only when the rea… |
CVE-2026-47426 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the private_key_jwt client authentication path uses ClientJwksResolverCache… |
CVE-2026-47424 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author… |
CVE-2026-46623 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with prof… |
CVE-2026-46619 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the reques… |
CVE-2026-46498 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers from the shared Core… |
CVE-2026-45794 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource f… |
CVE-2026-45052 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenticated remote reques… |
CVE-2026-45051 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorImpl object graph fro… |
CVE-2026-45048 | High | 8.5 | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ow… |
CVE-2026-44793 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration incons… |
CVE-2026-44203 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficientl… |
CVE-2026-44202 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated use… |
CVE-2026-41573 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId parameter from /jso… |
CVE-2026-73644 | Critical | 9.6 | 2026-08-13 | OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/se… |
CVE-2026-33439 | Critical | 9.8 | 2026-04-07 | Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code… |
CVE-2025-64099 | | | 2025-11-12 | Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the "claims_parameter_supported" parameter is activated, it i… |
CVE-2025-27497 | | | 2025-03-05 | OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresp… |
CVE-2024-41667 | High | 8.8 | 2024-07-24 | OpenAM is an open access management solution. In versions 15.0.3 and prior, the `getCustomLoginUrlTemplate` method in RealmOAuth2ProviderSettings.java is vulne… |
CVE-2023-37471 | Critical | 9.1 | 2023-07-20 | Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Se… |
CVE-2022-34298 | Medium | 5.3 | 2022-06-23 | The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack." |