{"schema_version":1,"title":"Open Identity Platform vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 22 vulnerabilities in Open Identity Platform: 0 in the last 7 days and 19 in the last 90 days, 7 of them critical and 0 exploited in the wild. The most recent, CVE-2026-46495, was published on 15 September 2026. 2 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/open-identity-platform","json_url":"https://junglewise.ai/threats/vendors/open-identity-platform.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/open-identity-platform","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":11,"all_time":22,"critical":7,"exploited":0,"last_7_days":0,"last_30_days":19,"last_90_days":19,"last_365_days":22},"latest":[{"cve":"CVE-2026-46495","cvss":4,"epss":0.0113,"slug":"cve-2026-46495-openidentityplatform-opendj-deserialization-rce-in-jmx-rmi","title":"OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/serv","severity":"critical","exploited":false,"published_at":"2026-09-15T15:17:15.493+00:00","url":"https://junglewise.ai/threats/cve-2026-46495-openidentityplatform-opendj-deserialization-rce-in-jmx-rmi"},{"cve":"CVE-2026-62379","cvss":9.8,"epss":0.0107,"slug":"cve-2026-62379-open-identity-platform-openam-rce-in-authxmlutils","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:06.107+00:00","url":"https://junglewise.ai/threats/cve-2026-62379-open-identity-platform-openam-rce-in-authxmlutils"},{"cve":"CVE-2026-62280","cvss":6.1,"epss":0.0033,"slug":"cve-2026-62280-open-identity-platform-openam-reflected-xss-in-oauth2-consent","title":"Open Access Management (OpenAM) is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap cons","severity":"medium","exploited":false,"published_at":"2026-09-15T10:17:05.957+00:00","url":"https://junglewise.ai/threats/cve-2026-62280-open-identity-platform-openam-reflected-xss-in-oauth2-consent"},{"cve":"CVE-2026-62263","cvss":4,"epss":0.0086,"slug":"cve-2026-62263-openidentityplatform-openam-java-deserialization-rce-in-webauthn","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInput","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:05.81+00:00","url":"https://junglewise.ai/threats/cve-2026-62263-openidentityplatform-openam-java-deserialization-rce-in-webauthn"},{"cve":"CVE-2026-53660","cvss":4,"epss":0.0041,"slug":"cve-2026-53660-openam-insecure-sso-cookie-initialization","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirector","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:05.527+00:00","url":"https://junglewise.ai/threats/cve-2026-53660-openam-insecure-sso-cookie-initialization"},{"cve":"CVE-2026-48717","cvss":4,"epss":0.0053,"slug":"cve-2026-48717-open-identity-platform-openam-oauth-authorization-bypass-in-pkce","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a code_verifie","severity":"medium","exploited":false,"published_at":"2026-09-15T10:17:05.377+00:00","url":"https://junglewise.ai/threats/cve-2026-48717-open-identity-platform-openam-oauth-authorization-bypass-in-pkce"},{"cve":"CVE-2026-47426","cvss":4,"epss":0.0055,"slug":"cve-2026-47426-open-identity-platform-openam-oauth-client-impersonation-in-jwks","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the private_key_jwt client authentication path uses Clien","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:05.23+00:00","url":"https://junglewise.ai/threats/cve-2026-47426-open-identity-platform-openam-oauth-client-impersonation-in-jwks"},{"cve":"CVE-2026-47424","cvss":4,"epss":0.0048,"slug":"cve-2026-47424-openidentityplatform-openam-rce-via-groovy-sandbox-escape","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:05.077+00:00","url":"https://junglewise.ai/threats/cve-2026-47424-openidentityplatform-openam-rce-via-groovy-sandbox-escape"},{"cve":"CVE-2026-46623","cvss":4,"epss":0.0067,"slug":"cve-2026-46623-openidentityplatform-openam-account-takeover-in-oauth2-module","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing loca","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:04.92+00:00","url":"https://junglewise.ai/threats/cve-2026-46623-openidentityplatform-openam-account-takeover-in-oauth2-module"},{"cve":"CVE-2026-46619","cvss":4,"epss":0.0099,"slug":"cve-2026-46619-open-identity-platform-openam-ldap-injection-in-msisdn-module","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module conc","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:04.77+00:00","url":"https://junglewise.ai/threats/cve-2026-46619-open-identity-platform-openam-ldap-injection-in-msisdn-module"},{"cve":"CVE-2026-46498","cvss":4,"epss":0.0041,"slug":"cve-2026-46498-openidentityplatform-openam-oauth-token-forgery-via-push","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers f","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:04.623+00:00","url":"https://junglewise.ai/threats/cve-2026-46498-openidentityplatform-openam-oauth-token-forgery-via-push"},{"cve":"CVE-2026-45794","cvss":4,"epss":0.0063,"slug":"cve-2026-45794-openidentityplatform-openam-unsafe-java-deserialization-in-sns","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by S","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:04.47+00:00","url":"https://junglewise.ai/threats/cve-2026-45794-openidentityplatform-openam-unsafe-java-deserialization-in-sns"},{"cve":"CVE-2026-45052","cvss":4,"epss":0.0077,"slug":"cve-2026-45052-open-identity-platform-openam-improper-authorization-in-liberty","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenti","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:04.307+00:00","url":"https://junglewise.ai/threats/cve-2026-45052-open-identity-platform-openam-improper-authorization-in-liberty"},{"cve":"CVE-2026-45051","cvss":4,"epss":0.0069,"slug":"cve-2026-45051-openidentityplatform-openam-java-deserialization-in-webauthn","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorIm","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:04.153+00:00","url":"https://junglewise.ai/threats/cve-2026-45051-openidentityplatform-openam-java-deserialization-in-webauthn"},{"cve":"CVE-2026-45048","cvss":8.5,"epss":0.0043,"slug":"cve-2026-45048-open-identity-platform-openam-privilege-escalation-in-session","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:03.993+00:00","url":"https://junglewise.ai/threats/cve-2026-45048-open-identity-platform-openam-privilege-escalation-in-session"},{"cve":"CVE-2026-44793","cvss":4,"epss":0.0059,"slug":"cve-2026-44793-open-identity-platform-openam-reflected-xss-in-saml2-federation","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered c","severity":"medium","exploited":false,"published_at":"2026-09-15T10:17:03.717+00:00","url":"https://junglewise.ai/threats/cve-2026-44793-open-identity-platform-openam-reflected-xss-in-saml2-federation"},{"cve":"CVE-2026-44203","cvss":9.3,"epss":0.0059,"slug":"cve-2026-44203-open-identity-platform-openam-reflected-xss-in-oauth2-state","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint d","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:03.51+00:00","url":"https://junglewise.ai/threats/cve-2026-44203-open-identity-platform-openam-reflected-xss-in-oauth2-state"},{"cve":"CVE-2026-44202","cvss":4,"epss":0.0041,"slug":"cve-2026-44202-open-identity-platform-openam-ssrf-in-sessionservice","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows a","severity":"medium","exploited":false,"published_at":"2026-09-15T10:17:03.35+00:00","url":"https://junglewise.ai/threats/cve-2026-44202-open-identity-platform-openam-ssrf-in-sessionservice"},{"cve":"CVE-2026-41573","cvss":4,"epss":0.005,"slug":"cve-2026-41573-open-identity-platform-openam-ldap-injection-in-crest-rest-api","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:03.123+00:00","url":"https://junglewise.ai/threats/cve-2026-41573-open-identity-platform-openam-ldap-injection-in-crest-rest-api"},{"cve":"CVE-2026-46560","cvss":7.5,"slug":"cve-2026-46560-openidentityplatform-openam-auth-bypass-in-radius-module","title":"OpenIdentityPlatform OpenAM auth bypass in RADIUS module","severity":"high","exploited":false,"published_at":"2026-06-25T17:22:24+00:00","url":"https://junglewise.ai/threats/cve-2026-46560-openidentityplatform-openam-auth-bypass-in-radius-module"},{"cve":"CVE-2026-45049","cvss":8.3,"slug":"cve-2026-45049-open-identity-platform-openam-session-hijacking-in-cdcservlet","title":"Open Identity Platform OpenAM session hijacking in CDCServlet","severity":"high","exploited":false,"published_at":"2026-06-23T17:33:14+00:00","url":"https://junglewise.ai/threats/cve-2026-45049-open-identity-platform-openam-session-hijacking-in-cdcservlet"},{"cve":"CVE-2026-33439","cvss":9.8,"epss":0.0843,"slug":"cve-2026-33439-openidentityplatform-openam-java-deserialization-rce-in-jato","title":"OpenIdentityPlatform OpenAM Java deserialization RCE in jato.clientSession","severity":"critical","exploited":false,"published_at":"2026-04-07T21:17:17.407+00:00","url":"https://junglewise.ai/threats/cve-2026-33439-openidentityplatform-openam-java-deserialization-rce-in-jato"}],"vendor":{"hub":true,"name":"Open Identity Platform","slug":"open-identity-platform","homepage":"https://www.openidentityplatform.org/","description":"The Open Identity Platform community maintains open-source identity and access management solutions.","url":"https://junglewise.ai/threats/vendors/open-identity-platform"},"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":6,"exploited":0,"vulnerabilities":19},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-33439","cvss":9.8,"epss":0.0843,"slug":"cve-2026-33439-openidentityplatform-openam-java-deserialization-rce-in-jato","title":"OpenIdentityPlatform OpenAM Java deserialization RCE in jato.clientSession","severity":"critical","exploited":false,"published_at":"2026-04-07T21:17:17.407+00:00","url":"https://junglewise.ai/threats/cve-2026-33439-openidentityplatform-openam-java-deserialization-rce-in-jato"},{"cve":"CVE-2026-62379","cvss":9.8,"epss":0.0107,"slug":"cve-2026-62379-open-identity-platform-openam-rce-in-authxmlutils","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:06.107+00:00","url":"https://junglewise.ai/threats/cve-2026-62379-open-identity-platform-openam-rce-in-authxmlutils"},{"cve":"CVE-2026-44203","cvss":9.3,"epss":0.0059,"slug":"cve-2026-44203-open-identity-platform-openam-reflected-xss-in-oauth2-state","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint d","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:03.51+00:00","url":"https://junglewise.ai/threats/cve-2026-44203-open-identity-platform-openam-reflected-xss-in-oauth2-state"},{"cve":"CVE-2026-46495","cvss":4,"epss":0.0113,"slug":"cve-2026-46495-openidentityplatform-opendj-deserialization-rce-in-jmx-rmi","title":"OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/serv","severity":"critical","exploited":false,"published_at":"2026-09-15T15:17:15.493+00:00","url":"https://junglewise.ai/threats/cve-2026-46495-openidentityplatform-opendj-deserialization-rce-in-jmx-rmi"},{"cve":"CVE-2026-62263","cvss":4,"epss":0.0086,"slug":"cve-2026-62263-openidentityplatform-openam-java-deserialization-rce-in-webauthn","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, WebAuthnAuthentication.deserialize applies an ObjectInput","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:05.81+00:00","url":"https://junglewise.ai/threats/cve-2026-62263-openidentityplatform-openam-java-deserialization-rce-in-webauthn"},{"cve":"CVE-2026-45052","cvss":4,"epss":0.0077,"slug":"cve-2026-45052-open-identity-platform-openam-improper-authorization-in-liberty","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenti","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:04.307+00:00","url":"https://junglewise.ai/threats/cve-2026-45052-open-identity-platform-openam-improper-authorization-in-liberty"},{"cve":"CVE-2026-45051","cvss":4,"epss":0.0069,"slug":"cve-2026-45051-openidentityplatform-openam-java-deserialization-in-webauthn","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorIm","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:04.153+00:00","url":"https://junglewise.ai/threats/cve-2026-45051-openidentityplatform-openam-java-deserialization-in-webauthn"},{"cve":"CVE-2026-45048","cvss":8.5,"epss":0.0043,"slug":"cve-2026-45048-open-identity-platform-openam-privilege-escalation-in-session","title":"Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:03.993+00:00","url":"https://junglewise.ai/threats/cve-2026-45048-open-identity-platform-openam-privilege-escalation-in-session"},{"cve":"CVE-2026-45049","cvss":8.3,"slug":"cve-2026-45049-open-identity-platform-openam-session-hijacking-in-cdcservlet","title":"Open Identity Platform OpenAM session hijacking in CDCServlet","severity":"high","exploited":false,"published_at":"2026-06-23T17:33:14+00:00","url":"https://junglewise.ai/threats/cve-2026-45049-open-identity-platform-openam-session-hijacking-in-cdcservlet"},{"cve":"CVE-2026-46560","cvss":7.5,"slug":"cve-2026-46560-openidentityplatform-openam-auth-bypass-in-radius-module","title":"OpenIdentityPlatform OpenAM auth bypass in RADIUS module","severity":"high","exploited":false,"published_at":"2026-06-25T17:22:24+00:00","url":"https://junglewise.ai/threats/cve-2026-46560-openidentityplatform-openam-auth-bypass-in-radius-module"}],"generated_at":"2026-09-28T03:07:00.154823+00:00","technologies":[{"name":"Open Identity Platform OpenAM Community Edition","slug":"openam-community-edition","vulnerabilities":12,"url":"https://junglewise.ai/threats/technologies/openam-community-edition"},{"name":"Open Identity Platform OpenAM","slug":"openam","vulnerabilities":8,"url":"https://junglewise.ai/threats/technologies/openam"}]}