CVE-2026-62280: Open Identity Platform OpenAM Reflected XSS in OAuth2 consent page

CVE-2026-62280 · Severity: medium · CVSS 6.1 · Published 2026-09-15

OpenAM, an open-source identity and access management solution, contains a vulnerability in its OAuth2/OIDC consent page. An attacker can trick a logged-in user into clicking a malicious link, allowing the attacker to run unauthorized code in the user's browser. This could lead to the theft of login sessions, sensitive data exposure, or full account takeover, including administrative accounts.

Technologies: org.openidentityplatform.openam:openam-oauth2 (Maven), Open Identity Platform OpenAM. Vendors: Maven, Open Identity Platform.

Quick answers

Is CVE-2026-62280 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62280 being exploited in the wild.
How severe is CVE-2026-62280?
Medium severity, with a CVSS score of 6.1, published 15 September 2026.
Which products and versions are affected?
org.openidentityplatform.openam:openam-oauth2 (Maven) >= 13.0.0, <= 16.1.1, ECOSYSTEM:introduced=13.0.0,fixed=16.1.2; Open Identity Platform OpenAM >= 13.0.0, <= 16.1.1.
Is there a fix for CVE-2026-62280?
Yes. org.openidentityplatform.openam:openam-oauth2 (Maven): upgrade to 16.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62280 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-62280?
Check whether you run org.openidentityplatform.openam:openam-oauth2 (Maven) or Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.openidentityplatform.openam:openam-oauth2 (Maven): upgrade to 16.1.2 or later
    # set org.openidentityplatform.openam:openam-oauth2 to 16.1.2 in your pom.xml or build.gradle

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in OpenAM's OAuth2/OIDC component. The root cause is the failure to properly escape request-derived values before rendering them in the HTML response of the consent page when the 'display=wap' parameter is used. An attacker can exploit this by inducing an authenticated user to visit a specially crafted 'authorize' URL. Successful exploitation allows for arbitrary JavaScript execution within the OpenAM origin, potentially leading to session cookie theft, CSRF token exfiltration, or administrative takeover. This issue is a regression or incomplete fix related to a previous vulnerability class. A fix is available in version 16.1.2.

Affected products

  • Open Identity Platform OpenAM OAuth2/OIDC module >= 13.0.0, <= 16.1.1

Identifiers

  • CVE-2026-62280
  • GHSA-vqxv-6xrh-49cp

Timeline

  • 2026-07-23: disclosed
  • 2026-07-24: advisory: GitHub Advisory published
  • 2026-07-24: patched: Version 16.1.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.