CVE-2026-44203

Name of the Vulnerable Software and Affected Versions Open Access Management (OpenAM) versions prior to 16.1.1

Description The OAuth 2.0 and OpenID Connect authorization endpoint fails to sufficiently encode user-supplied parameters, including the state variable, before they are rendered into HTML by FormPostResponse.ftl and checkSession.ftl when using the form post response mode. This allows an unauthenticated attacker to trick a user into opening a specially crafted authorization request to execute arbitrary script within the OpenAM origin. This is a Reflected Cross-Site Scripting (XSS) issue, where a script is reflected off a web application to the user's browser.

Recommendations Update to version 16.1.1.