Is CVE-2026-105114 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105114 being exploited in the wild.

How severe is CVE-2026-105114?

Medium severity, with a CVSS score of 6.1, published 3 October 2026.

Which products and versions are affected?

Open Identity Platform OpenAM before 16.1.3.

How is CVE-2026-105114 attacked?

It is attacked over the network.

Am I affected by CVE-2026-105114?

Check whether you run Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105114: OpenAM reflected XSS in OAuth2 authorization error page

CVE-2026-105114 · Severity: medium · CVSS 6.1 · Published 2026-10-03

OpenAM is an identity and access management platform that handles OAuth2 authentication for applications. A reflected cross-site scripting vulnerability in the OAuth2 error page allows attackers to inject malicious scripts by sending victims a crafted link. If a victim visits the link while logged in, the attacker can steal session tokens, manipulate the page, or redirect users to phishing sites.

Technologies: Open Identity Platform OpenAM. Vendors: Open Identity Platform.

Quick answers

Is CVE-2026-105114 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105114 being exploited in the wild.
How severe is CVE-2026-105114?: Medium severity, with a CVSS score of 6.1, published 3 October 2026.
Which products and versions are affected?: Open Identity Platform OpenAM before 16.1.3.
Is there a fix for CVE-2026-105114?: Yes: fixed in 16.1.3. Until then: Deploy a Content-Security-Policy header that disallows inline scripts to prevent payload execution even if reflection is not blocked. Restrict access to /oauth2/authorize at the reverse proxy to networks that actually need it, or apply a web application firewall rule rejecting requests with < or > characters in the query string. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105114 attacked?: It is attacked over the network.
Am I affected by CVE-2026-105114?: Check whether you run Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 16.1.3

Deploy a Content-Security-Policy header that disallows inline scripts to prevent payload execution even if reflection is not blocked. Restrict access to /oauth2/authorize at the reverse proxy to networks that actually need it, or apply a web application firewall rule rejecting requests with < or > characters in the query string.

Technical details

The vulnerability is a reflected XSS (CWE-79) in the OAuth2 /authorize endpoint's error page, where user-supplied parameters are inserted into the DOM without HTML encoding. An unauthenticated attacker can craft a malicious link with repeated or specially-crafted parameters that break out of the HTML context and execute arbitrary JavaScript in the OpenAM origin. The attacker requires user interaction (victim clicking a link) but no special privileges or client configuration beyond a registered OAuth2 client, which is standard for deployments using OAuth2.

Affected products

Open Identity Platform OpenAM before 16.1.3

Timeline

2026-09-18: disclosed
2026-09-18: patched: OpenAM 16.1.3 released
2026-10-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.