Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-44203OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

High 8.3

In plain English

A high-severity cross-site scripting in OpenAM from OpenIdentityPlatform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.3High

Exploit odds (30 days)0.6%top 51.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the form_post response mode. An unauthenticated attacker can induce a user to open a crafted authorization request and execute script in the OpenAM origin. This issue is fixed in version 16.1.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.openidentityplatform.openam:openam-oauth2	16.1.1	GHSA-fq9h-c788-fx73

Affected products (as reported)

Vendor	Product	Versions
OpenIdentityPlatform	OpenAM	< 16.1.1

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N

References

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-fq9h-c788-fx73 x_refsource_CONFIRM
https://github.com/OpenIdentityPlatform/OpenAM/commit/078bd4754905f5130eaa7bbe45f958eaeb7fd0d7 x_refsource_MISC
https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1 x_refsource_MISC