CVE-2026-44793: Open Identity Platform OpenAM reflected XSS in SAML2 federation library

Executive brief

OpenAM, an open-source access management solution, contains a security flaw in its federation library. In certain clustered server environments, an attacker could trick a user's browser into executing malicious scripts. This could allow an attacker to perform actions on behalf of the user or steal session information without needing to log in first.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the OpenAM federation library within the SAML2 Cluster Cookie-Hash-Redirect path. The root cause is the inconsistent application of output encoding in the `FSUtils.postToTarget` method when rendering user-supplied parameters into HTML responses. This vulnerability is exploitable without authentication but requires a non-default configuration typically found in clustered deployments. An attacker can achieve script execution in the context of the victim's session by inducing a user to visit a specially crafted URL. The issue is addressed in version 16.1.1.

Affected products

• Open Identity Platform OpenAM federation library < 16.1.1

Timeline

• 2026-06-22: disclosed
• 2026-06-22: advisory
• 2026-06-22: patched: Fixed in version 16.1.1

References

• https://api.github.com/users/gujjuboy10x00
• https://github.com/gujjuboy10x00
• https://api.github.com/users/gujjuboy10x00/gists%7B/gist_id%7D
• https://api.github.com/users/gujjuboy10x00/repos
• https://avatars.githubusercontent.com/u/32534328?v=4
• https://api.github.com/users/gujjuboy10x00/events%7B/privacy%7D