Executive brief
OpenAM, an open-source identity and access management solution, contains a vulnerability in its OAuth2/OIDC consent page. An attacker can trick a logged-in user into clicking a malicious link, allowing the attacker to run unauthorized code in the user's browser. This could lead to the theft of login sessions, sensitive data exposure, or full account takeover, including administrative accounts.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in OpenAM's OAuth2/OIDC component. The root cause is the failure to properly escape request-derived values before rendering them in the HTML response of the consent page when the 'display=wap' parameter is used. An attacker can exploit this by inducing an authenticated user to visit a specially crafted 'authorize' URL. Successful exploitation allows for arbitrary JavaScript execution within the OpenAM origin, potentially leading to session cookie theft, CSRF token exfiltration, or administrative takeover. This issue is a regression or incomplete fix related to a previous vulnerability class. A fix is available in version 16.1.2.
Affected products
- Open Identity Platform OpenAM OAuth2/OIDC module >= 13.0.0, <= 16.1.1
Timeline
- 2026-07-23: disclosed
- 2026-07-24: advisory: GitHub Advisory published
- 2026-07-24: patched: Version 16.1.2 released