Skip to content

org.openidentityplatform.openam:openam-server-only

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium6.9
CVE-2026-123553

OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login

OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth) with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to obtain authenticated sessions, and the agent identities can read the configuration of other agent profiles.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM
critical10.0
CVE-2026-123551

OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket

OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM
medium4.7
CVE-2026-123548

OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages

OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed lists. Attackers can craft OpenAM-domain links that send users to arbitrary external sites for phishing.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM
medium4.7
CVE-2026-123547

OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState

OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrlList is configured. Attackers can craft single sign-on links with a malicious RelayState to send users from the trusted OpenAM origin to phishing sites and bypass URL filters.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM
medium6.1
CVE-2026-123546

OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFail

OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run script in the XUI to steal session cookies.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM
medium6.8
CVE-2026-123544

OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel

OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving processes, tamper with writable files, and possibly execute code.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM
high8.7
CVE-2026-123543

OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java Deserialisation

OpenAM before 16.1.4 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending serialized Java data without size or structure limits. Attackers can send small crafted requests to remote SDK endpoints, classic login pages, or the administration console to block authentication, session validation and policy decisions.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenIdentityPlatform · OpenAM / OpenIdentityPlatform · OpenAM