{"schema_version":1,"title":"Open Identity Platform OpenAM vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 8 vulnerabilities in Open Identity Platform OpenAM: 0 in the last 7 days and 7 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-62379, was published on 15 September 2026.","url":"https://junglewise.ai/threats/technologies/openam","json_url":"https://junglewise.ai/threats/technologies/openam.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/openam","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":2,"all_time":8,"critical":3,"exploited":0,"last_7_days":0,"last_30_days":7,"last_90_days":7,"last_365_days":8},"latest":[{"cve":"CVE-2026-62379","cvss":9.8,"epss":0.0107,"slug":"cve-2026-62379-open-identity-platform-openam-rce-in-authxmlutils","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:06.107+00:00","url":"https://junglewise.ai/threats/cve-2026-62379-open-identity-platform-openam-rce-in-authxmlutils"},{"cve":"CVE-2026-62280","cvss":6.1,"epss":0.0033,"slug":"cve-2026-62280-open-identity-platform-openam-reflected-xss-in-oauth2-consent","title":"Open Access Management (OpenAM) is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap cons","severity":"medium","exploited":false,"published_at":"2026-09-15T10:17:05.957+00:00","url":"https://junglewise.ai/threats/cve-2026-62280-open-identity-platform-openam-reflected-xss-in-oauth2-consent"},{"cve":"CVE-2026-53660","cvss":4,"epss":0.0041,"slug":"cve-2026-53660-openam-insecure-sso-cookie-initialization","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirector","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:05.527+00:00","url":"https://junglewise.ai/threats/cve-2026-53660-openam-insecure-sso-cookie-initialization"},{"cve":"CVE-2026-44793","cvss":4,"epss":0.0059,"slug":"cve-2026-44793-open-identity-platform-openam-reflected-xss-in-saml2-federation","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered c","severity":"medium","exploited":false,"published_at":"2026-09-15T10:17:03.717+00:00","url":"https://junglewise.ai/threats/cve-2026-44793-open-identity-platform-openam-reflected-xss-in-saml2-federation"},{"cve":"CVE-2026-44203","cvss":9.3,"epss":0.0059,"slug":"cve-2026-44203-open-identity-platform-openam-reflected-xss-in-oauth2-state","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint d","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:03.51+00:00","url":"https://junglewise.ai/threats/cve-2026-44203-open-identity-platform-openam-reflected-xss-in-oauth2-state"},{"cve":"CVE-2026-44202","cvss":4,"epss":0.0041,"slug":"cve-2026-44202-open-identity-platform-openam-ssrf-in-sessionservice","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows a","severity":"medium","exploited":false,"published_at":"2026-09-15T10:17:03.35+00:00","url":"https://junglewise.ai/threats/cve-2026-44202-open-identity-platform-openam-ssrf-in-sessionservice"},{"cve":"CVE-2026-41573","cvss":4,"epss":0.005,"slug":"cve-2026-41573-open-identity-platform-openam-ldap-injection-in-crest-rest-api","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:03.123+00:00","url":"https://junglewise.ai/threats/cve-2026-41573-open-identity-platform-openam-ldap-injection-in-crest-rest-api"},{"cve":"CVE-2026-33439","cvss":9.8,"epss":0.0843,"slug":"cve-2026-33439-openidentityplatform-openam-java-deserialization-rce-in-jato","title":"OpenIdentityPlatform OpenAM Java deserialization RCE in jato.clientSession","severity":"critical","exploited":false,"published_at":"2026-04-07T21:17:17.407+00:00","url":"https://junglewise.ai/threats/cve-2026-33439-openidentityplatform-openam-java-deserialization-rce-in-jato"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":2,"exploited":0,"vulnerabilities":7},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Open Identity Platform OpenAM Community Edition","slug":"openam-community-edition","vulnerabilities":12,"url":"https://junglewise.ai/threats/technologies/openam-community-edition"}],"technology":{"hub":true,"name":"Open Identity Platform OpenAM","slug":"openam","vendor":{"name":"Open Identity Platform","slug":"open-identity-platform","url":"https://junglewise.ai/threats/vendors/open-identity-platform"},"aliases":[],"category":"identity-management","description":"Open-source identity and access management platform for authentication and authorization.","url":"https://junglewise.ai/threats/technologies/openam"},"most_severe":[{"cve":"CVE-2026-33439","cvss":9.8,"epss":0.0843,"slug":"cve-2026-33439-openidentityplatform-openam-java-deserialization-rce-in-jato","title":"OpenIdentityPlatform OpenAM Java deserialization RCE in jato.clientSession","severity":"critical","exploited":false,"published_at":"2026-04-07T21:17:17.407+00:00","url":"https://junglewise.ai/threats/cve-2026-33439-openidentityplatform-openam-java-deserialization-rce-in-jato"},{"cve":"CVE-2026-62379","cvss":9.8,"epss":0.0107,"slug":"cve-2026-62379-open-identity-platform-openam-rce-in-authxmlutils","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:06.107+00:00","url":"https://junglewise.ai/threats/cve-2026-62379-open-identity-platform-openam-rce-in-authxmlutils"},{"cve":"CVE-2026-44203","cvss":9.3,"epss":0.0059,"slug":"cve-2026-44203-open-identity-platform-openam-reflected-xss-in-oauth2-state","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint d","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:03.51+00:00","url":"https://junglewise.ai/threats/cve-2026-44203-open-identity-platform-openam-reflected-xss-in-oauth2-state"},{"cve":"CVE-2026-41573","cvss":4,"epss":0.005,"slug":"cve-2026-41573-open-identity-platform-openam-ldap-injection-in-crest-rest-api","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:03.123+00:00","url":"https://junglewise.ai/threats/cve-2026-41573-open-identity-platform-openam-ldap-injection-in-crest-rest-api"},{"cve":"CVE-2026-53660","cvss":4,"epss":0.0041,"slug":"cve-2026-53660-openam-insecure-sso-cookie-initialization","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirector","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:05.527+00:00","url":"https://junglewise.ai/threats/cve-2026-53660-openam-insecure-sso-cookie-initialization"},{"cve":"CVE-2026-62280","cvss":6.1,"epss":0.0033,"slug":"cve-2026-62280-open-identity-platform-openam-reflected-xss-in-oauth2-consent","title":"Open Access Management (OpenAM) is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap cons","severity":"medium","exploited":false,"published_at":"2026-09-15T10:17:05.957+00:00","url":"https://junglewise.ai/threats/cve-2026-62280-open-identity-platform-openam-reflected-xss-in-oauth2-consent"},{"cve":"CVE-2026-44793","cvss":4,"epss":0.0059,"slug":"cve-2026-44793-open-identity-platform-openam-reflected-xss-in-saml2-federation","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered c","severity":"medium","exploited":false,"published_at":"2026-09-15T10:17:03.717+00:00","url":"https://junglewise.ai/threats/cve-2026-44793-open-identity-platform-openam-reflected-xss-in-saml2-federation"},{"cve":"CVE-2026-44202","cvss":4,"epss":0.0041,"slug":"cve-2026-44202-open-identity-platform-openam-ssrf-in-sessionservice","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows a","severity":"medium","exploited":false,"published_at":"2026-09-15T10:17:03.35+00:00","url":"https://junglewise.ai/threats/cve-2026-44202-open-identity-platform-openam-ssrf-in-sessionservice"}],"generated_at":"2026-09-26T14:07:00.158513+00:00"}