CVE-2026-44203
Received Received - Intake

Cross-Site Scripting in OpenAM OAuth 2.0 Endpoint

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the form_post response mode. An unauthenticated attacker can induce a user to open a crafted authorization request and execute script in the OpenAM origin. This issue is fixed in version 16.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-44203
EUVD
EUVD-2026-78356

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
forgerock openam 16.1.1
openidentityplatform openam 16.1.1
openidentityplatform openam From 13 (inc) to 16.0.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-44203 is a reflected cross-site scripting (XSS) vulnerability in OpenAM, an access management solution. It affects the OAuth 2.0 and OpenID Connect authorization endpoint in versions 13 through 16.0.6. The flaw occurs because user-supplied parameters are not properly encoded before being rendered in HTML responses for the form_post response mode. This allows attackers to inject malicious scripts into the page, which execute in the context of the OpenAM origin.

Detection Guidance

To detect this vulnerability, inspect OpenAM instances running versions 13 through 16.0.6 for improperly sanitized user-supplied parameters in OAuth2/OIDC authorization endpoints. Check FormPostResponse.ftl and checkSession.ftl templates for missing HTML escaping of redirectUri, formValues, and baseUrl parameters.

Impact Analysis

An attacker could trick a user into opening a crafted authorization request, leading to execution of arbitrary JavaScript in the user's browser within the OpenAM domain. This could result in session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of the user. The attack requires user interaction and does not affect pre-authentication flows.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using affected OpenAM versions may face compliance violations, potential fines, and increased risk of data breaches due to the possibility of session hijacking and data theft.

Mitigation Strategies

Upgrade OpenAM to version 16.1.1 or later to apply the patch. If immediate upgrade is not possible, restrict access to the OAuth2/OIDC authorization endpoints via network controls or WAF rules to block malicious input.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44203. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart