CVE-2026-44203: Open Identity Platform OpenAM Reflected XSS in OAuth2 state parameter

Executive brief

OpenAM, an open-source access management solution, contains a security flaw in its login and authorization components. An attacker can use this vulnerability to inject malicious scripts into a user's browser session before they have even logged in. If successful, this could allow the attacker to steal sensitive session information, impersonate users, or perform unauthorized actions within the identity platform.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the OpenAM OAuth2/OIDC authorization endpoint. The root cause is the insufficient sanitization of the 'state' parameter when the 'response_mode' is set to 'form_post', specifically within the 'FormPostResponse.ftl' template. A remote, unauthenticated attacker can exploit this by tricking a user into clicking a specially crafted link. This allows for the execution of arbitrary JavaScript in the context of the OpenAM origin, potentially leading to session hijacking or credential theft. The issue is fixed in version 16.1.1.

Affected products

• Open Identity Platform OpenAM OAuth2 >= 13.0.0, < 16.1.1

Timeline

• 2026-06-21: disclosed
• 2026-06-22: advisory

References

• https://api.github.com/users/gujjuboy10x00
• https://github.com/gujjuboy10x00
• https://api.github.com/users/gujjuboy10x00/gists%7B/gist_id%7D
• https://api.github.com/users/gujjuboy10x00/repos
• https://avatars.githubusercontent.com/u/32534328?v=4
• https://api.github.com/users/gujjuboy10x00/events%7B/privacy%7D