{"schema_version":1,"title":"OpenIdentityPlatform vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 13 vulnerabilities in OpenIdentityPlatform: 2 in the last 7 days and 12 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123548, was published on 8 November 2026. 3 vulnerabilities in the last four weeks, down 67% on the four before (9). 0 critical against 3. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/openidentityplatform","json_url":"https://junglewise.ai/threats/vendors/openidentityplatform.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/openidentityplatform","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":6,"all_time":13,"critical":4,"exploited":0,"last_7_days":2,"last_30_days":3,"last_90_days":12,"last_365_days":13},"latest":[{"cve":"CVE-2026-123548","cvss":4.7,"slug":"cve-2026-123548-openidentityplatform-openam-before-16-1-4-contains-an-open","title":"OpenIdentityPlatform OpenAM open redirect in WS-Federation and SAML pages","severity":"medium","exploited":false,"published_at":"2026-11-08T02:16:46.093+00:00","url":"https://junglewise.ai/threats/cve-2026-123548-openidentityplatform-openam-before-16-1-4-contains-an-open"},{"cve":"CVE-2026-123543","cvss":7.5,"slug":"cve-2026-123543-openam-before-16-1-4-contains-a-denial-of-service-vulnerability","title":"OpenAM denial of service in Java deserialization","severity":"high","exploited":false,"published_at":"2026-11-08T02:16:45.253+00:00","url":"https://junglewise.ai/threats/cve-2026-123543-openam-before-16-1-4-contains-a-denial-of-service-vulnerability"},{"cve":"CVE-2026-46560","cvss":7.5,"slug":"cve-2026-46560-openidentityplatform-openam-auth-bypass-in-radius-module","title":"OpenIdentityPlatform OpenAM auth bypass in RADIUS module","severity":"high","exploited":false,"published_at":"2026-10-30T19:18:25.203+00:00","url":"https://junglewise.ai/threats/cve-2026-46560-openidentityplatform-openam-auth-bypass-in-radius-module"},{"cve":"CVE-2026-105122","cvss":5.4,"epss":0.0023,"slug":"cve-2026-105122-openam-before-16-1-3-contains-a-server-side-request-forgery","title":"OpenAM server-side request forgery in OAuth 2.0 client jwks_uri","severity":"medium","exploited":false,"published_at":"2026-10-03T14:16:39.14+00:00","url":"https://junglewise.ai/threats/cve-2026-105122-openam-before-16-1-3-contains-a-server-side-request-forgery"},{"cve":"CVE-2026-105118","cvss":4.7,"epss":0.001,"slug":"cve-2026-105118-openam-before-16-1-3-contains-an-open-redirect-vulnerability","title":"OpenAM open redirect in end-session endpoint via unverified id_token_hint","severity":"medium","exploited":false,"published_at":"2026-10-03T14:16:38.563+00:00","url":"https://junglewise.ai/threats/cve-2026-105118-openam-before-16-1-3-contains-an-open-redirect-vulnerability"},{"cve":"CVE-2026-46495","cvss":4,"epss":0.0113,"slug":"cve-2026-46495-openidentityplatform-opendj-deserialization-rce-in-jmx-rmi","title":"OpenIdentityPlatform OpenDJ deserialization RCE in JMX RMI","severity":"critical","exploited":false,"published_at":"2026-09-15T15:17:15.493+00:00","url":"https://junglewise.ai/threats/cve-2026-46495-openidentityplatform-opendj-deserialization-rce-in-jmx-rmi"},{"cve":"CVE-2026-62263","cvss":4,"epss":0.0086,"slug":"cve-2026-62263-openidentityplatform-openam-java-deserialization-rce-in-webauthn","title":"OpenIdentityPlatform OpenAM Java deserialization RCE in WebAuthn","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:05.81+00:00","url":"https://junglewise.ai/threats/cve-2026-62263-openidentityplatform-openam-java-deserialization-rce-in-webauthn"},{"cve":"CVE-2026-47424","cvss":4,"epss":0.0048,"slug":"cve-2026-47424-openidentityplatform-openam-rce-via-groovy-sandbox-escape","title":"OpenIdentityPlatform OpenAM RCE via Groovy sandbox escape","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:05.077+00:00","url":"https://junglewise.ai/threats/cve-2026-47424-openidentityplatform-openam-rce-via-groovy-sandbox-escape"},{"cve":"CVE-2026-46623","cvss":4,"epss":0.0067,"slug":"cve-2026-46623-openidentityplatform-openam-account-takeover-in-oauth2-module","title":"OpenIdentityPlatform OpenAM account takeover in OAuth2 module","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:04.92+00:00","url":"https://junglewise.ai/threats/cve-2026-46623-openidentityplatform-openam-account-takeover-in-oauth2-module"},{"cve":"CVE-2026-46498","cvss":4,"epss":0.0041,"slug":"cve-2026-46498-openidentityplatform-openam-oauth-token-forgery-via-push","title":"OpenIdentityPlatform OpenAM OAuth token forgery via Push Registration","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:04.623+00:00","url":"https://junglewise.ai/threats/cve-2026-46498-openidentityplatform-openam-oauth-token-forgery-via-push"},{"cve":"CVE-2026-45794","cvss":4,"epss":0.0063,"slug":"cve-2026-45794-openidentityplatform-openam-unsafe-java-deserialization-in-sns","title":"OpenIdentityPlatform OpenAM unsafe Java deserialization in SNS callback","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:04.47+00:00","url":"https://junglewise.ai/threats/cve-2026-45794-openidentityplatform-openam-unsafe-java-deserialization-in-sns"},{"cve":"CVE-2026-45051","cvss":4,"epss":0.0069,"slug":"cve-2026-45051-openidentityplatform-openam-java-deserialization-in-webauthn","title":"OpenIdentityPlatform OpenAM Java deserialization in WebAuthn module","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:04.153+00:00","url":"https://junglewise.ai/threats/cve-2026-45051-openidentityplatform-openam-java-deserialization-in-webauthn"},{"cve":"CVE-2026-33439","cvss":9.8,"epss":0.0843,"slug":"cve-2026-33439-openidentityplatform-openam-java-deserialization-rce-in-jato","title":"OpenIdentityPlatform OpenAM Java deserialization RCE in jato.clientSession","severity":"critical","exploited":false,"published_at":"2026-04-07T21:17:17.407+00:00","url":"https://junglewise.ai/threats/cve-2026-33439-openidentityplatform-openam-java-deserialization-rce-in-jato"}],"vendor":{"hub":true,"name":"OpenIdentityPlatform","slug":"openidentityplatform","description":"Organization that maintains OpenAM, an open-source identity and access management platform.","url":"https://junglewise.ai/threats/vendors/openidentityplatform"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":3,"exploited":0,"vulnerabilities":7},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-33439","cvss":9.8,"epss":0.0843,"slug":"cve-2026-33439-openidentityplatform-openam-java-deserialization-rce-in-jato","title":"OpenIdentityPlatform OpenAM Java deserialization RCE in jato.clientSession","severity":"critical","exploited":false,"published_at":"2026-04-07T21:17:17.407+00:00","url":"https://junglewise.ai/threats/cve-2026-33439-openidentityplatform-openam-java-deserialization-rce-in-jato"},{"cve":"CVE-2026-46495","cvss":4,"epss":0.0113,"slug":"cve-2026-46495-openidentityplatform-opendj-deserialization-rce-in-jmx-rmi","title":"OpenIdentityPlatform OpenDJ deserialization RCE in JMX RMI","severity":"critical","exploited":false,"published_at":"2026-09-15T15:17:15.493+00:00","url":"https://junglewise.ai/threats/cve-2026-46495-openidentityplatform-opendj-deserialization-rce-in-jmx-rmi"},{"cve":"CVE-2026-62263","cvss":4,"epss":0.0086,"slug":"cve-2026-62263-openidentityplatform-openam-java-deserialization-rce-in-webauthn","title":"OpenIdentityPlatform OpenAM Java deserialization RCE in WebAuthn","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:05.81+00:00","url":"https://junglewise.ai/threats/cve-2026-62263-openidentityplatform-openam-java-deserialization-rce-in-webauthn"},{"cve":"CVE-2026-45051","cvss":4,"epss":0.0069,"slug":"cve-2026-45051-openidentityplatform-openam-java-deserialization-in-webauthn","title":"OpenIdentityPlatform OpenAM Java deserialization in WebAuthn module","severity":"critical","exploited":false,"published_at":"2026-09-15T10:17:04.153+00:00","url":"https://junglewise.ai/threats/cve-2026-45051-openidentityplatform-openam-java-deserialization-in-webauthn"},{"cve":"CVE-2026-123543","cvss":7.5,"slug":"cve-2026-123543-openam-before-16-1-4-contains-a-denial-of-service-vulnerability","title":"OpenAM denial of service in Java deserialization","severity":"high","exploited":false,"published_at":"2026-11-08T02:16:45.253+00:00","url":"https://junglewise.ai/threats/cve-2026-123543-openam-before-16-1-4-contains-a-denial-of-service-vulnerability"},{"cve":"CVE-2026-46560","cvss":7.5,"slug":"cve-2026-46560-openidentityplatform-openam-auth-bypass-in-radius-module","title":"OpenIdentityPlatform OpenAM auth bypass in RADIUS module","severity":"high","exploited":false,"published_at":"2026-10-30T19:18:25.203+00:00","url":"https://junglewise.ai/threats/cve-2026-46560-openidentityplatform-openam-auth-bypass-in-radius-module"},{"cve":"CVE-2026-46623","cvss":4,"epss":0.0067,"slug":"cve-2026-46623-openidentityplatform-openam-account-takeover-in-oauth2-module","title":"OpenIdentityPlatform OpenAM account takeover in OAuth2 module","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:04.92+00:00","url":"https://junglewise.ai/threats/cve-2026-46623-openidentityplatform-openam-account-takeover-in-oauth2-module"},{"cve":"CVE-2026-45794","cvss":4,"epss":0.0063,"slug":"cve-2026-45794-openidentityplatform-openam-unsafe-java-deserialization-in-sns","title":"OpenIdentityPlatform OpenAM unsafe Java deserialization in SNS callback","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:04.47+00:00","url":"https://junglewise.ai/threats/cve-2026-45794-openidentityplatform-openam-unsafe-java-deserialization-in-sns"},{"cve":"CVE-2026-47424","cvss":4,"epss":0.0048,"slug":"cve-2026-47424-openidentityplatform-openam-rce-via-groovy-sandbox-escape","title":"OpenIdentityPlatform OpenAM RCE via Groovy sandbox escape","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:05.077+00:00","url":"https://junglewise.ai/threats/cve-2026-47424-openidentityplatform-openam-rce-via-groovy-sandbox-escape"},{"cve":"CVE-2026-46498","cvss":4,"epss":0.0041,"slug":"cve-2026-46498-openidentityplatform-openam-oauth-token-forgery-via-push","title":"OpenIdentityPlatform OpenAM OAuth token forgery via Push Registration","severity":"high","exploited":false,"published_at":"2026-09-15T10:17:04.623+00:00","url":"https://junglewise.ai/threats/cve-2026-46498-openidentityplatform-openam-oauth-token-forgery-via-push"}],"generated_at":"2026-11-09T03:07:00.176479+00:00","technologies":[{"name":"OpenIdentityPlatform OpenAM","slug":"openidentityplatform-openam","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/openidentityplatform-openam"}]}