Is CVE-2026-123539 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123539 being exploited in the wild.

How severe is CVE-2026-123539?

Medium severity, with a CVSS score of 4.8, published 8 November 2026.

Which products and versions are affected?

Open Identity Platform OpenAM before 16.1.4.

How is CVE-2026-123539 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123539?

Check whether you run Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123539: OpenAM stored cross-site scripting in OAuth 2.0 consent page

CVE-2026-123539 · Severity: medium · CVSS 4.8 · Published 2026-11-08

OpenAM is an identity and access management platform that handles user authentication and authorization for enterprise applications. A stored cross-site scripting vulnerability in the OAuth 2.0/OpenID Connect consent page allows privileged attackers to inject malicious script through a user's display name, which executes when other users grant authorization. An attacker with administrative access can steal session cookies to impersonate victims and access all applications protected by OpenAM.

Technologies: Open Identity Platform OpenAM. Vendors: Open Identity Platform.

Quick answers

Is CVE-2026-123539 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123539 being exploited in the wild.
How severe is CVE-2026-123539?: Medium severity, with a CVSS score of 4.8, published 8 November 2026.
Which products and versions are affected?: Open Identity Platform OpenAM before 16.1.4.
Is there a fix for CVE-2026-123539?: Yes: fixed in OpenAM 16.1.4. Until then: Until upgrading: set the advanced server property com.sun.identity.cookie.httponly to true to prevent script from reading the session cookie (verify no integrations depend on script access to the cookie); restrict administrative rights to modify user display names; avoid mapping display-name attributes from untrusted federation partners; review existing user profiles for markup-containing display names and correct them. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123539 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123539?: Check whether you run Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: OpenAM 16.1.4

Until upgrading: set the advanced server property com.sun.identity.cookie.httponly to true to prevent script from reading the session cookie (verify no integrations depend on script access to the cookie); restrict administrative rights to modify user display names; avoid mapping display-name attributes from untrusted federation partners; review existing user profiles for markup-containing display names and correct them.

Technical details

The OAuth 2.0/OpenID Connect consent page fails to HTML-encode the user's display name before rendering it in the page, allowing injection of arbitrary markup and script. Exploitation requires high privilege (administrator or federation partner with attribute provisioning rights) and user interaction (the victim must visit the consent page), but can result in session hijacking via cookie theft. The vulnerability is fixed in OpenAM 16.1.4 by encoding display names on the consent page.

Affected products

Open Identity Platform OpenAM before 16.1.4

Timeline

2026-10-22: disclosed
2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.