[ CVE-2026-105116 · Published 3 Oct 2026 ]
Vulnerability in OpenIdentityPlatform OpenAM
CVSS 6.1
EPSS <1%No fix listed yet
[ Description ]Official description
OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce auto-submit page. If reachable with cookieHashRedirectEnabled set, crafted requests could execute script in the OpenAM origin, though an unrelated HTTP 500 failure prevents exploitation in released versions.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.