CVE-2026-62280

Name of the Vulnerable Software and Affected Versions Open Access Management (OpenAM) versions 13.0.0 through 16.1.1

Description The OAuth2 authorize endpoint's consent page, when using display=wap, reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without proper HTML escaping. This allows an attacker to trick a user with an active session into following a crafted link to execute arbitrary JavaScript within the OpenAM origin. This can lead to session or cookie theft, CSRF-token disclosure, and unauthorized actions using the victim's privileges, including potential administrative takeover. The issue is reachable on any deployment with at least one registered OAuth2 client.

Recommendations Update to version 16.1.2. Restrict or limit access to the OAuth2 authorize endpoint. Treat unsolicited display=wap authorize links as untrusted.