CVE-2026-123539
Received Received - Intake

Stored XSS in OpenAM Session Consent Page

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that allows privileged attackers to inject script by placing markup in a user's display name. When the victim reaches the OAuth 2.0 / OpenID Connect consent page, the unencoded name executes script that can steal the OpenAM session cookie to impersonate the user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123539
EUVD
EUVD-2026-119424

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
forgerock openam to 16.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in OpenAM versions before 16.1.4. A privileged attacker can inject malicious script into a user's display name. When the victim accesses the OAuth 2.0 or OpenID Connect consent page, the unencoded display name executes the script, potentially stealing the OpenAM session cookie to impersonate the user.

Detection Guidance

To detect this vulnerability, inspect OpenAM user profiles for display names containing unencoded HTML or JavaScript markup. Check the OAuth 2.0 consent page for improperly rendered display names. Review server logs for requests to the consent page that may indicate script execution.

Impact Analysis

If exploited, this vulnerability allows an attacker to steal your OpenAM session cookie and impersonate you across applications protected by OpenAM. This could lead to unauthorized access to sensitive data or actions performed on your behalf.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance penalties if this flaw is exploited.

Mitigation Strategies
  • Upgrade OpenAM to version 16.1.4 or later to fix the encoding issue.
  • Set the OpenAM session cookie to HttpOnly to prevent theft via XSS.
  • Restrict who can modify user display names to privileged administrators only.
  • Review existing user profiles for malicious markup in display names and remove it.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123539. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...