Skip to content
cve.newCreate a CVE report

org.openidentityplatform.openam:openam-federation-library

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

critical10.0
CVE-2026-123551

OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket

OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM
critical9.8
CVE-2026-123550

OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions

OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM
medium4.7
CVE-2026-123548

OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages

OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed lists. Attackers can craft OpenAM-domain links that send users to arbitrary external sites for phishing.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM
medium4.7
CVE-2026-123547

OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState

OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrlList is configured. Attackers can craft single sign-on links with a malicious RelayState to send users from the trusted OpenAM origin to phishing sites and bypass URL filters.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM
medium5.3
CVE-2026-123541

OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching

OpenAM before 16.1.4 contains an open redirect vulnerability that allows remote attackers to redirect users after SAML 1.x single sign-on by exploiting loose trusted-partner destination matching. Attackers can craft links to /SAMLAwareServlet or /SAMLPOSTProfileServlet with a destination host resembling a trusted partner to send authenticated users to attacker-controlled phishing sites.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM
low2.0
CVE-2026-123540

OpenAM before 16.1.4 Incomplete Attribute Encoding in SAML 1.x Form POST

OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to alter attribute values by injecting unencoded content into the service provider auto-submitted form. Attackers controlling a trusted identity provider can craft assertion attribute names or values that reach the target application in modified form, undermining the integrity of received attributes.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM
high7.5
CVE-2026-123538

OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation

OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner named as its issuer, accepting a signature from any certificate in OpenAM's keystore. An attacker holding such a private key, such as a trusted SAML 1.x partner, can forge assertions claiming another partner's issuer and sign in as that partner's users, including privileged ones.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM
low2.3
GHSA-fhrq-3gmx-p879Package fixes recorded

OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`

Certain federation endpoints do not consistently apply output encoding when rendering user-supplied parameters into HTML responses. Under a non-default configuration used in some clustered deployments, this inconsistency can result in reflected XSS in the OpenAM origin without authentication.

Recorded fixes — org.openidentityplatform.openam:openam-federation-library: 16.1.1. Check your release branch.

Exploitation not established

Maven / org.openidentityplatform.openam:openam-federation-library
org.openidentityplatform.openam:openam-federation-library Maven
Affected range Recorded fix
Earlier releases before 16.1.1Ecosystem versions16.1.1

Version evidence: OSV · GHSA-fhrq-3gmx-p879

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "16.1.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "14.5.2",
    "14.5.3",
    "14.5.4",
    "14.6.1",
    "14.6.2",
    "14.6.3",
    "14.6.4",
    "14.6.5",
    "14.6.6",
    "14.7.0",
    "14.7.1",
    "14.7.2",
    "14.7.3",
    "14.7.4",
    "14.8.1",
    "14.8.2",
    "14.8.3",
    "14.8.4",
    "15.0.0",
    "15.0.1",
    "15.0.2",
    "15.0.3",
    "15.0.4",
    "15.1.0",
    "15.1.1",
    "15.1.2",
    "15.1.3",
    "15.1.4",
    "15.1.5",
    "15.1.6",
    "15.2.0",
    "15.2.1",
    "15.2.2",
    "16.0.1",
    "16.0.2",
    "16.0.3",
    "16.0.4",
    "16.0.5",
    "16.0.6",
    "16.1.0"
  ]
}