{"schema_version":1,"title":"Open Identity Platform OpenAM Community Edition vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 12 vulnerabilities in Open Identity Platform OpenAM Community Edition: 0 in the last 7 days and 10 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-53660, was published on 15 September 2026.","url":"https://junglewise.ai/threats/technologies/openam-community-edition","json_url":"https://junglewise.ai/threats/technologies/openam-community-edition.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/openam-community-edition","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":9,"all_time":12,"critical":2,"exploited":0,"last_7_days":0,"last_30_days":10,"last_90_days":10,"last_365_days":12},"latest":[{"cve":"CVE-2026-53660","cvss":4,"epss":0.0041,"slug":"cve-2026-53660-openam-insecure-sso-cookie-initialization","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirector","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:05.527+00:00","url":"https://junglewise.ai/threats/cve-2026-53660-openam-insecure-sso-cookie-initialization"},{"cve":"CVE-2026-48717","cvss":4,"epss":0.0053,"slug":"cve-2026-48717-open-identity-platform-openam-oauth-authorization-bypass-in-pkce","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a code_verifie","severity":"medium","exploited":false,"published_at":"2026-09-15T10:17:05.377+00:00","url":"https://junglewise.ai/threats/cve-2026-48717-open-identity-platform-openam-oauth-authorization-bypass-in-pkce"},{"cve":"CVE-2026-47426","cvss":4,"epss":0.0055,"slug":"cve-2026-47426-open-identity-platform-openam-oauth-client-impersonation-in-jwks","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the private_key_jwt client authentication path uses Clien","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:05.23+00:00","url":"https://junglewise.ai/threats/cve-2026-47426-open-identity-platform-openam-oauth-client-impersonation-in-jwks"},{"cve":"CVE-2026-47424","cvss":4,"epss":0.0048,"slug":"cve-2026-47424-openidentityplatform-openam-rce-via-groovy-sandbox-escape","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:05.077+00:00","url":"https://junglewise.ai/threats/cve-2026-47424-openidentityplatform-openam-rce-via-groovy-sandbox-escape"},{"cve":"CVE-2026-46619","cvss":4,"epss":0.0099,"slug":"cve-2026-46619-open-identity-platform-openam-ldap-injection-in-msisdn-module","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module conc","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:04.77+00:00","url":"https://junglewise.ai/threats/cve-2026-46619-open-identity-platform-openam-ldap-injection-in-msisdn-module"},{"cve":"CVE-2026-46498","cvss":4,"epss":0.0041,"slug":"cve-2026-46498-openidentityplatform-openam-oauth-token-forgery-via-push","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers f","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:04.623+00:00","url":"https://junglewise.ai/threats/cve-2026-46498-openidentityplatform-openam-oauth-token-forgery-via-push"},{"cve":"CVE-2026-45794","cvss":4,"epss":0.0063,"slug":"cve-2026-45794-openidentityplatform-openam-unsafe-java-deserialization-in-sns","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by S","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:04.47+00:00","url":"https://junglewise.ai/threats/cve-2026-45794-openidentityplatform-openam-unsafe-java-deserialization-in-sns"},{"cve":"CVE-2026-45052","cvss":4,"epss":0.0077,"slug":"cve-2026-45052-open-identity-platform-openam-improper-authorization-in-liberty","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenti","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:04.307+00:00","url":"https://junglewise.ai/threats/cve-2026-45052-open-identity-platform-openam-improper-authorization-in-liberty"},{"cve":"CVE-2026-45051","cvss":4,"epss":0.0069,"slug":"cve-2026-45051-openidentityplatform-openam-java-deserialization-in-webauthn","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorIm","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:04.153+00:00","url":"https://junglewise.ai/threats/cve-2026-45051-openidentityplatform-openam-java-deserialization-in-webauthn"},{"cve":"CVE-2026-45048","cvss":8.5,"epss":0.0043,"slug":"cve-2026-45048-open-identity-platform-openam-privilege-escalation-in-session","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:03.993+00:00","url":"https://junglewise.ai/threats/cve-2026-45048-open-identity-platform-openam-privilege-escalation-in-session"},{"cve":"CVE-2026-46560","cvss":7.5,"slug":"cve-2026-46560-openidentityplatform-openam-auth-bypass-in-radius-module","title":"OpenIdentityPlatform OpenAM auth bypass in RADIUS module","severity":"high","exploited":false,"published_at":"2026-06-25T17:22:24+00:00","url":"https://junglewise.ai/threats/cve-2026-46560-openidentityplatform-openam-auth-bypass-in-radius-module"},{"cve":"CVE-2026-45049","cvss":8.3,"slug":"cve-2026-45049-open-identity-platform-openam-session-hijacking-in-cdcservlet","title":"Open Identity Platform OpenAM session hijacking in CDCServlet","severity":"high","exploited":false,"published_at":"2026-06-23T17:33:14+00:00","url":"https://junglewise.ai/threats/cve-2026-45049-open-identity-platform-openam-session-hijacking-in-cdcservlet"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":2,"exploited":0,"vulnerabilities":10},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Open Identity Platform OpenAM","slug":"openam","vulnerabilities":8,"url":"https://junglewise.ai/threats/technologies/openam"}],"technology":{"hub":true,"name":"Open Identity Platform OpenAM Community Edition","slug":"openam-community-edition","vendor":{"name":"Open Identity Platform","slug":"open-identity-platform","url":"https://junglewise.ai/threats/vendors/open-identity-platform"},"aliases":[],"category":"identity-management","homepage":"https://www.openidentityplatform.org/openam","repo_url":"https://github.com/OpenIdentityPlatform/OpenAM","description":"An open-source access management, entitlements, and federation server platform.","url":"https://junglewise.ai/threats/technologies/openam-community-edition"},"most_severe":[{"cve":"CVE-2026-45052","cvss":4,"epss":0.0077,"slug":"cve-2026-45052-open-identity-platform-openam-improper-authorization-in-liberty","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenti","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:04.307+00:00","url":"https://junglewise.ai/threats/cve-2026-45052-open-identity-platform-openam-improper-authorization-in-liberty"},{"cve":"CVE-2026-45051","cvss":4,"epss":0.0069,"slug":"cve-2026-45051-openidentityplatform-openam-java-deserialization-in-webauthn","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorIm","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:04.153+00:00","url":"https://junglewise.ai/threats/cve-2026-45051-openidentityplatform-openam-java-deserialization-in-webauthn"},{"cve":"CVE-2026-45048","cvss":8.5,"epss":0.0043,"slug":"cve-2026-45048-open-identity-platform-openam-privilege-escalation-in-session","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:03.993+00:00","url":"https://junglewise.ai/threats/cve-2026-45048-open-identity-platform-openam-privilege-escalation-in-session"},{"cve":"CVE-2026-45049","cvss":8.3,"slug":"cve-2026-45049-open-identity-platform-openam-session-hijacking-in-cdcservlet","title":"Open Identity Platform OpenAM session hijacking in CDCServlet","severity":"high","exploited":false,"published_at":"2026-06-23T17:33:14+00:00","url":"https://junglewise.ai/threats/cve-2026-45049-open-identity-platform-openam-session-hijacking-in-cdcservlet"},{"cve":"CVE-2026-46560","cvss":7.5,"slug":"cve-2026-46560-openidentityplatform-openam-auth-bypass-in-radius-module","title":"OpenIdentityPlatform OpenAM auth bypass in RADIUS module","severity":"high","exploited":false,"published_at":"2026-06-25T17:22:24+00:00","url":"https://junglewise.ai/threats/cve-2026-46560-openidentityplatform-openam-auth-bypass-in-radius-module"},{"cve":"CVE-2026-46619","cvss":4,"epss":0.0099,"slug":"cve-2026-46619-open-identity-platform-openam-ldap-injection-in-msisdn-module","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module conc","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:04.77+00:00","url":"https://junglewise.ai/threats/cve-2026-46619-open-identity-platform-openam-ldap-injection-in-msisdn-module"},{"cve":"CVE-2026-45794","cvss":4,"epss":0.0063,"slug":"cve-2026-45794-openidentityplatform-openam-unsafe-java-deserialization-in-sns","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by S","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:04.47+00:00","url":"https://junglewise.ai/threats/cve-2026-45794-openidentityplatform-openam-unsafe-java-deserialization-in-sns"},{"cve":"CVE-2026-47426","cvss":4,"epss":0.0055,"slug":"cve-2026-47426-open-identity-platform-openam-oauth-client-impersonation-in-jwks","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the private_key_jwt client authentication path uses Clien","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:05.23+00:00","url":"https://junglewise.ai/threats/cve-2026-47426-open-identity-platform-openam-oauth-client-impersonation-in-jwks"},{"cve":"CVE-2026-47424","cvss":4,"epss":0.0048,"slug":"cve-2026-47424-openidentityplatform-openam-rce-via-groovy-sandbox-escape","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:05.077+00:00","url":"https://junglewise.ai/threats/cve-2026-47424-openidentityplatform-openam-rce-via-groovy-sandbox-escape"},{"cve":"CVE-2026-53660","cvss":4,"epss":0.0041,"slug":"cve-2026-53660-openam-insecure-sso-cookie-initialization","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirector","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:05.527+00:00","url":"https://junglewise.ai/threats/cve-2026-53660-openam-insecure-sso-cookie-initialization"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}