CVE-2026-44793
Received Received - Intake

OpenAM SAML2 Cookie-Hash Redirect Stored XSS

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can induce a user to follow a crafted request and execute script in the OpenAM origin. This issue is fixed in version 16.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-44793
EUVD
EUVD-2026-78351

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
forgerock openam 16.1.1
forgerock openam to 16.1.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-44793 is a reflected Cross-Site Scripting (XSS) vulnerability in OpenAM, a federated identity management solution. It occurs in certain federation endpoints that fail to properly encode user-supplied parameters in HTML responses during pre-authentication. This flaw is exploitable in non-default clustered configurations, allowing attackers to execute malicious scripts in the OpenAM origin without authentication.

Detection Guidance

Detecting this vulnerability requires checking OpenAM versions prior to 16.1.1 and inspecting federation endpoints for inconsistent parameter encoding. Review server logs for unusual SAML2 cluster cookie-hash redirect paths or reflected XSS attempts. No specific commands are provided in the resources.

Impact Analysis

An attacker could trick a user into following a crafted link, leading to script execution in the OpenAM origin. This may result in session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of the user. The impact depends on the user's privileges and the data accessible through OpenAM.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using vulnerable OpenAM versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade OpenAM to version 16.1.1 or later immediately. If upgrading is not possible, disable affected federation endpoints or apply input validation for user-supplied parameters like the STATE parameter in SAML2 requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44793. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart