These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwks_uri. This vulnerability can lead to denial of service or probing of internal hosts and metadata endpoints. Defenders responsible for OpenAM instances, especially those exposed to untrusted client registr [truncated]
CVE-2026-105121 is an improper authorization vulnerability in OpenAM before 16.1.3 that allows delegated administrators to destroy sessions outside their realms. Authenticated accounts with the iplanet-am-session-destroy-sessions attribute can forcibly log out users in any realm. This issue has a CVSS score of 6.9 and is considered medium severity.
CVE-2026-105120 is an authorization bypass vulnerability in OpenAM before 16.1.3. The sessions REST endpoint query operation allows realm administrators to list sessions of every realm. Attackers with delegated RealmAdmin privileges can disclose usernames, universal IDs, and session handles across tenant boundaries by supplying a _queryFilter naming another realm.
OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through OpenID Connect hybrid flows (code token, code id_token, code token id_token) carry no bound challenge. An attacker who intercepts such a code can redeem it for a public client's tokens with any non-empty code_verifier.
OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint. This vulnerability enables phishing attacks that borrow the OpenAM host's trust by allowing attackers to name any realm client in a forged hint to redirect victims to any registered post-logout URI. Defende [truncated]
CVE-2026-105117 is an email content injection vulnerability in OpenAM before 16.1.3. Attackers can use the forgotPassword and register actions to control notification email wording, potentially leading to phishing attacks. This vulnerability allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/{realm}/users. The vulnerability can be us [truncated]
OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce auto-submit page. If reachable with cookieHashRedirectEnabled set, crafted requests could execute script in the OpenAM origin, though an unrelated HTTP 500 failure prevents exploitation in released versions.
CVE-2026-105115 is a high-severity vulnerability in OpenAM before version 16.1.3, allowing unauthenticated arbitrary class instantiation via the legacy JAX-RPC SOAP interface. This vulnerability can lead to server crashes, classpath probing, and potentially code execution via gadget chains. Defenders should assess exposure and apply patches or mitigations to prevent these potential impacts. The vulnerabil [truncated]
CVE-2026-105114 is a reflected cross-site scripting vulnerability in OpenAM before 16.1.3. The vulnerability allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeated parameters to run JavaScript in the OpenAM origin, acting within existing session [truncated]
Open Access Management (OpenAM) is vulnerable to pre-authentication code execution via the /authservice PLL endpoint. The endpoint allows instantiation of arbitrary Java classes without proper verification, enabling attackers to execute code in the server process. This issue is fixed in version 16.1.2. Affected OpenAM deployments should be assessed for exposure, and patched to version 16.1.2 or later to p [truncated]
A critical vulnerability was found in Open Access Management (OpenAM) prior to version 16.1.2, allowing a pre-authentication attacker to bypass the incomplete remediation for an earlier WebAuthn deserialization vulnerability. The issue arises from the WebAuthnAuthentication.deserialize method applying an ObjectInputFilter that permits every serialized object at depth greater than 1, effectively constraini [truncated]
Open Access Management (OpenAM) is vulnerable to a session hijacking issue. Prior to version 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie with HttpOnly disabled and without a protective SameSite default. This allows an attacker to read and reuse the cookie to steal the SSO session and complete attacker-driven consent grants when combined with same-origin cross-site scri [truncated]
Open Access Management (OpenAM) has a critical vulnerability prior to version 16.1.1. The AuthorizationCodeGrantTypeHandler requires a code_verifier only when the realm-wide codeVerifierEnforced setting is enabled. However, even when an authorization code stores a code_challenge, the code_verifier is not always required due to the default disabled setting. This allows an attacker who intercepts a PKCE-pro [truncated]
Open Access Management (OpenAM) has a vulnerability prior to version 16.1.1 that allows an attacker controlling any registered client with published keys to authenticate as another client and mint tokens in that client's name across realms in the same OpenAM process. This issue arises from the private_key_jwt client authentication path using ClientJwksResolverCache without reliably binding a cached jwks_u [truncated]
CVE-2026-47424 is a high-severity vulnerability in Open Access Management (OpenAM) that allows an authenticated server-side script author to execute operating-system commands as the OpenAM application server account. This issue, fixed in version 16.1.1, can compromise the JVM and every realm it serves. The vulnerability exists due to a flaw in the GroovySandboxValueFilter, which permits script authors to [truncated]
Open Access Management (OpenAM) OAuth2 authentication module updates local accounts with sensitive attributes, allowing unauthenticated attackers to take over accounts without interacting with the identity provider. This issue arises when account creation is enabled, permitting repeated OAuth login to accept the username as both identifier and password. The vulnerability can be exploited by rewriting the [truncated]
An unauthenticated remote attacker can inject LDAP filter metacharacters into Open Access Management (OpenAM) MSISDN authentication module and obtain a normal authenticated OpenAM session without a password. This vulnerability allows for arbitrary user selection and session creation, impacting OpenAM instances with the MSISDN module enabled. Defenders should assess exposure and prioritize upgrading to ver [truncated]
An Open Access Management (OpenAM) vulnerability allows an attacker to mint OAuth bearer tokens and OpenID Connect ID tokens with chosen subject, client, realm, and scope by placing controlled JSON in the Core Token Store (CTS) under a known token identifier. This issue is fixed in version 16.1.1. The vulnerability can be exploited to create unauthorized tokens, potentially bypassing authentication and au [truncated]
Open Access Management (OpenAM) is vulnerable to deserialization of untrusted data prior to version 16.1.1. The WebAuthnAuthentication module loads a serialized AuthenticatorImpl object graph from a user attribute without an ObjectInputFilter, allowing for potential code execution when specific non-default conditions are met, including the WebAuthn flow being reachable and an attacker having previously wr [truncated]
A vulnerability in Open Access Management (OpenAM) prior to version 16.1.1 allows a low-privileged authenticated user to retrieve active session credentials of another user, potentially leading to session hijacking. This issue arises from the SessionRequestHandler in the session management endpoint not enforcing ownership or privilege checks. As a result, an attacker who knows a target identity identifier [truncated]
CVE-2026-44793 is a high-severity vulnerability in Open Access Management (OpenAM) that allows an unauthenticated attacker to execute script in the OpenAM origin by inducing a user to follow a crafted request. The issue is fixed in version 16.1.1. This vulnerability affects OpenAM deployments in non-default clustered configurations. Defenders should assess exposure and prioritize patching to prevent poten [truncated]
Open Access Management (OpenAM) OAuth 2.0 and OpenID Connect authorization endpoint insufficiently encodes user-supplied parameters, allowing an unauthenticated attacker to execute script in the OpenAM origin by inducing a user to open a crafted authorization request. This issue is fixed in version 16.1.1. The vulnerability allows script execution in the OpenAM origin, potentially leading to unauthorized [truncated]
CVE-2026-44202 is a vulnerability in Open Access Management (OpenAM) that allows an authenticated user to register an arbitrary notification URL, potentially disclosing session-related notification data. The issue is fixed in version 16.1.1. This vulnerability affects OpenAM servers with authenticated user access, allowing an attacker to make outbound requests and potentially disclose session-related data [truncated]
This PatchSiren debrief is based on CVE-2026-41573, which describes a vulnerability in Open Access Management (OpenAM) prior to version 16.1.1. The issue allows an authenticated attacker to inject LDAP metacharacters for user enumeration and blind LDAP injection. The vulnerability has a CVSS score of 7.1 and is considered HIGH severity. The issue is fixed in version 16.1.1. Defenders should assess exposur [truncated]
PatchSiren debrief for CVE-2026-73644: OpenDJ SASL PLAIN authorization identity path vulnerability allows an authenticated account with PROXIED_AUTH privilege to assume unauthorized identities. This issue is fixed in OpenDJ version 5.1.2. Defenders should prioritize patching and monitor authentication events to prevent potential privilege escalation and lateral movement. The vulnerability affects OpenDJ d [truncated]
CVE-2026-33439 is a pre-authentication Remote Code Execution (RCE) vulnerability in OpenAM, an access management solution. The vulnerability exists in OpenAM versions prior to 16.0.6 and allows an unauthenticated attacker to achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP cont [truncated]
