Skip to content
cve.newCreate a CVE report

org.openidentityplatform.openam:openam-core-rest

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium6.9
CVE-2026-123553

OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login

OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth) with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to obtain authenticated sessions, and the agent identities can read the configuration of other agent profiles.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM
critical9.8
CVE-2026-123549

OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass

OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join administrative groups and gain full administrative control of OpenAM.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM
medium6.1
CVE-2026-123546

OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFail

OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run script in the XUI to steal session cookies.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM
high8.7
GHSA-2vg8-q4c2-5cw3Package fixes recorded

OpenAM has LDAP Injection via `_queryId` Parameter

OpenAM (Open Identity Platform) is an open-source IAM platform providing SSO, OAuth2, SAML, and OpenID Connect capabilities. The CREST REST API layer exposes user query endpoints under /json/{realm}/users. In IdentityResourceV1.queryCollection(), the HTTP query parameter _queryId is passed to a CrestQuery object with escapeQueryId explicitly set to false, bypassing the escape protection introduced as part of the CVE-2021-29156 fix. The unescaped value flows directly to DJLDAPv3Repo.getFilter() where it is concatenated into an LDAP filter string without sanitization, enabling authenticated attackers to inject arbitrary LDAP metacharacters for user enumeration and blind LDAP injection.

Recorded fixes — org.openidentityplatform.openam:openam-core-rest: 16.1.1. Check your release branch.

Exploitation not established

Maven / org.openidentityplatform.openam:openam-core-rest
org.openidentityplatform.openam:openam-core-rest Maven
Affected range Recorded fix
Earlier releases before 16.1.1Ecosystem versions16.1.1

Version evidence: OSV · GHSA-2vg8-q4c2-5cw3

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "16.1.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "14.5.2",
    "14.5.3",
    "14.5.4",
    "14.6.1",
    "14.6.2",
    "14.6.3",
    "14.6.4",
    "14.6.5",
    "14.6.6",
    "14.7.0",
    "14.7.1",
    "14.7.2",
    "14.7.3",
    "14.7.4",
    "14.8.1",
    "14.8.2",
    "14.8.3",
    "14.8.4",
    "15.0.0",
    "15.0.1",
    "15.0.2",
    "15.0.3",
    "15.0.4",
    "15.1.0",
    "15.1.1",
    "15.1.2",
    "15.1.3",
    "15.1.4",
    "15.1.5",
    "15.1.6",
    "15.2.0",
    "15.2.1",
    "15.2.2",
    "16.0.1",
    "16.0.2",
    "16.0.3",
    "16.0.4",
    "16.0.5",
    "16.0.6",
    "16.1.0"
  ]
}