PT-2026-139820

CVE-2026-123539

Published

2026-11-08

Updated

2026-11-08

Description by

CVSS 3.1

4.8

Medium

MetricsAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.4

Description A stored cross-site scripting issue exists where privileged attackers can inject scripts by placing markup in a user's display name. The script executes when a victim accesses the OAuth 2.0 / OpenID Connect consent page, potentially allowing the attacker to steal the OpenAM session cookie and impersonate the user.

Recommendations Update to version 16.1.4.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products