Skip to content
cve.newCreate a CVE report

org.openidentityplatform.openam:openam-core

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium6.9
CVE-2026-123553

OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login

OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth) with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to obtain authenticated sessions, and the agent identities can read the configuration of other agent profiles.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM
medium6.1
CVE-2026-123546

OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFail

OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run script in the XUI to steal session cookies.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM
high8.7
CVE-2026-123543

OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java Deserialisation

OpenAM before 16.1.4 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending serialized Java data without size or structure limits. Attackers can send small crafted requests to remote SDK endpoints, classic login pages, or the administration console to block authentication, session validation and policy decisions.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM
high7.0
GHSA-fpmh-vx4h-xc33Package fixes recorded

OpenAM Insecure SSO Cookie Initialization

Description An Insecure Default Initialization of Resource (CWE-1188) issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.

Recorded fixes — org.openidentityplatform.openam:openam-core: 16.1.1. Check your release branch.

Exploitation not established

Maven / org.openidentityplatform.openam:openam-core
org.openidentityplatform.openam:openam-core Maven
Affected range Recorded fix
Earlier releases before 16.1.1Ecosystem versions16.1.1

Version evidence: OSV · GHSA-fpmh-vx4h-xc33

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "16.1.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "14.5.2",
    "14.5.3",
    "14.5.4",
    "14.6.1",
    "14.6.2",
    "14.6.3",
    "14.6.4",
    "14.6.5",
    "14.6.6",
    "14.7.0",
    "14.7.1",
    "14.7.2",
    "14.7.3",
    "14.7.4",
    "14.8.1",
    "14.8.2",
    "14.8.3",
    "14.8.4",
    "15.0.0",
    "15.0.1",
    "15.0.2",
    "15.0.3",
    "15.0.4",
    "15.1.0",
    "15.1.1",
    "15.1.2",
    "15.1.3",
    "15.1.4",
    "15.1.5",
    "15.1.6",
    "15.2.0",
    "15.2.1",
    "15.2.2",
    "16.0.1",
    "16.0.2",
    "16.0.3",
    "16.0.4",
    "16.0.5",
    "16.0.6",
    "16.1.0"
  ]
}
org.openidentityplatform.openam:openam-core Maven
Affected range Recorded fix
Earlier releases before 16.1.1Ecosystem versions16.1.1

Version evidence: OSV · GHSA-vvhj-w2jq-263q

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "16.1.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "14.5.2",
    "14.5.3",
    "14.5.4",
    "14.6.1",
    "14.6.2",
    "14.6.3",
    "14.6.4",
    "14.6.5",
    "14.6.6",
    "14.7.0",
    "14.7.1",
    "14.7.2",
    "14.7.3",
    "14.7.4",
    "14.8.1",
    "14.8.2",
    "14.8.3",
    "14.8.4",
    "15.0.0",
    "15.0.1",
    "15.0.2",
    "15.0.3",
    "15.0.4",
    "15.1.0",
    "15.1.1",
    "15.1.2",
    "15.1.3",
    "15.1.4",
    "15.1.5",
    "15.1.6",
    "15.2.0",
    "15.2.1",
    "15.2.2",
    "16.0.1",
    "16.0.2",
    "16.0.3",
    "16.0.4",
    "16.0.5",
    "16.0.6",
    "16.1.0"
  ]
}
medium6.2
GHSA-c556-q2mh-477vPackage fixes recorded

OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`

OpenAM (Open Identity Platform) is an open-source Identity and Access Management (IAM) platform derived from ForgeRock OpenAM, providing SSO, OAuth2, SAML, and OpenID Connect capabilities. It is widely deployed in enterprise environments as a central authentication gateway.

Recorded fixes — org.openidentityplatform.openam:openam-core: 16.1.1. Check your release branch.

Exploitation not established

Maven / org.openidentityplatform.openam:openam-core
org.openidentityplatform.openam:openam-core Maven
Affected range Recorded fix
Earlier releases before 16.1.1Ecosystem versions16.1.1

Version evidence: OSV · GHSA-c556-q2mh-477v

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "16.1.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "14.5.2",
    "14.5.3",
    "14.5.4",
    "14.6.1",
    "14.6.2",
    "14.6.3",
    "14.6.4",
    "14.6.5",
    "14.6.6",
    "14.7.0",
    "14.7.1",
    "14.7.2",
    "14.7.3",
    "14.7.4",
    "14.8.1",
    "14.8.2",
    "14.8.3",
    "14.8.4",
    "15.0.0",
    "15.0.1",
    "15.0.2",
    "15.0.3",
    "15.0.4",
    "15.1.0",
    "15.1.1",
    "15.1.2",
    "15.1.3",
    "15.1.4",
    "15.1.5",
    "15.1.6",
    "15.2.0",
    "15.2.1",
    "15.2.2",
    "16.0.1",
    "16.0.2",
    "16.0.3",
    "16.0.4",
    "16.0.5",
    "16.0.6",
    "16.1.0"
  ]
}