CVE-2026-62280
Received Received - Intake

Stored XSS in OpenAM OAuth2 Authorize Endpoint

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Open Access Management (OpenAM) is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an active OpenAM session to follow a crafted authorization link and execute JavaScript in the OpenAM origin, enabling session or cookie theft, CSRF-token disclosure, and actions with the victim's privileges. At least one registered OAuth2 client is required, but the attacker does not need to control that client. This issue is fixed in version 16.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-62280
EUVD
EUVD-2026-78365

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
forgerock openam From 13.0.0 (inc) to 16.1.2 (inc)
openidentityplatform openam From 13.0.0 (inc) to 16.1.1 (inc)
openidentityplatform openam 16.1.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62280 is a reflected Cross-Site Scripting (XSS) vulnerability in OpenAM's OAuth2/OIDC wap consent page. It affects versions 13.0.0 to 16.1.1. The issue occurs because the consent page reflects user-supplied input into the HTML response without proper escaping when handling display=wap authorize requests. An attacker can trick a user with an active OpenAM session into clicking a malicious link, enabling arbitrary JavaScript execution within the OpenAM domain.

Detection Guidance

To detect this vulnerability, check if your OpenAM instance is running a vulnerable version (13.0.0 to 16.1.1). Inspect the OAuth2 authorize endpoint for the display=wap consent page. Look for reflected user input in the HTML response without proper HTML escaping. Verify if the ConsentRequiredResource.java and authorize.ftl files match the vulnerable code structure before the fix.

Impact Analysis

This vulnerability can lead to session or cookie theft, CSRF token exfiltration, and potential administrative account takeover if the victim has elevated privileges. Attackers can execute malicious scripts in the OpenAM origin, compromising user sessions and sensitive data.

Mitigation Strategies

Upgrade OpenAM to version 16.1.2 or later immediately. If upgrading is not possible, restrict access to the OAuth2 authorize endpoint and treat unsolicited display=wap authorize links as untrusted. Monitor for unusual activity or unauthorized actions in the OpenAM domain.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62280. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart