PT-2026-51443 · Maven · Org.Openidentityplatform.Openam:Openam-Federation-Library

Published 2026-06-22 · Updated 2026-06-22 · CVE-2026-44793

OSV

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Summary

Certain federation endpoints do not consistently apply output encoding when rendering user-supplied parameters into HTML responses. Under a non-default configuration used in some clustered deployments, this inconsistency can result in reflected XSS in the OpenAM origin without authentication.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-44793

GHSA-FHRQ-3GMX-P879

Affected Products

Org.Openidentityplatform.Openam:Openam-Federation-Library

References · 4

• https://osv.dev/vulnerability/GHSA-fhrq-3gmx-p879 · Vendor Advisory
• https://github.com/OpenIdentityPlatform/OpenAM · Note
• https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-fhrq-3gmx-p879 · Note
• https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1 · Note