# CVE-2024-41667: OpenAM FreeMarker template injection

Source: https://junglewise.ai/threats/cve-2024-41667-openam-freemarker-template-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-07-25  
License: CC BY 4.0 with a link back

CVE-2024-41667 · Severity: low · CVSS 3.1 · Published 2024-07-25

OpenAM FreeMarker template injection

Technologies: [org.openidentityplatform.openam:openam-oauth2 (Maven)](https://junglewise.ai/threats/technologies/org-openidentityplatform-openam-openam-oauth2). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2024-41667 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-41667 being exploited in the wild.

**How severe is CVE-2024-41667?** Low severity, with a CVSS score of 3.1, published 25 July 2024.

**Which products and versions are affected?** org.openidentityplatform.openam:openam-oauth2 (Maven) ECOSYSTEM:introduced=0,fixed=15.0.4.

**Is there a fix for CVE-2024-41667?** Yes. org.openidentityplatform.openam:openam-oauth2 (Maven): upgrade to 15.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2024-41667?** Check whether you run org.openidentityplatform.openam:openam-oauth2 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.openidentityplatform.openam:openam-oauth2 (Maven): upgrade to 15.0.4 or later

  ```sh
  # set org.openidentityplatform.openam:openam-oauth2 to 15.0.4 in your pom.xml or build.gradle
  ```


## Affected products

- org.openidentityplatform.openam:openam-oauth2 (Maven) ECOSYSTEM:introduced=0,fixed=15.0.4

## Identifiers

- CVE-2024-41667
- GHSA-7726-43hg-m23v

## Related threats

- [Open Identity Platform OpenAM Reflected XSS in OAuth2 consent page](https://junglewise.ai/threats/cve-2026-62280-open-identity-platform-openam-reflected-xss-in-oauth2-consent)
- [Open Identity Platform OpenAM OAuth authorization bypass in PKCE challenge](https://junglewise.ai/threats/cve-2026-48717-open-identity-platform-openam-oauth-authorization-bypass-in-pkce)
- [Open Identity Platform OpenAM OAuth client impersonation in JWKS resolver](https://junglewise.ai/threats/cve-2026-47426-open-identity-platform-openam-oauth-client-impersonation-in-jwks)
- [OpenIdentityPlatform OpenAM OAuth token forgery via Push Registration](https://junglewise.ai/threats/cve-2026-46498-openidentityplatform-openam-oauth-token-forgery-via-push)
- [Open Identity Platform OpenAM Reflected XSS in OAuth2 state parameter](https://junglewise.ai/threats/cve-2026-44203-open-identity-platform-openam-reflected-xss-in-oauth2-state)