[ Vendor · 9 CVEs ]
OpenIdentityPlatform
CVEs affecting OpenIdentityPlatform published in the last 30 days, plus any OpenIdentityPlatform CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-105122 | 3 Oct 2026 | CVSS 5.4 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make… | |
| CVE-2026-105115 | 3 Oct 2026 | CVSS 8.6 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote… | |
| CVE-2026-105116 | 3 Oct 2026 | CVSS 6.1 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the… | |
| CVE-2026-105117 | 3 Oct 2026 | CVSS 6.1 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording… | |
| CVE-2026-105118 | 3 Oct 2026 | CVSS 4.7 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified… | |
| CVE-2026-105119 | 3 Oct 2026 | CVSS 6.8 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued… | |
| CVE-2026-105120 | 3 Oct 2026 | CVSS 4.9 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to… | |
| CVE-2026-105121 | 3 Oct 2026 | CVSS 4.9 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms… | |
| CVE-2026-105114 | 3 Oct 2026 | CVSS 6.1 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying… |