Reflected XSS in OpenAM OAuth2 Authorization Page

Executive Summary

CVE-2026-105114 is a reflected cross-site scripting (XSS) vulnerability in OpenAM versions before 16.1.3. It allows unauthenticated attackers to inject malicious scripts by crafting parameters on the OAuth2 authorization error page. User input is rendered unencoded, enabling JavaScript execution in the OpenAM origin. Victims may be tricked via a specially crafted /oauth2/authorize link with repeated parameters.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for requests to the /oauth2/authorize endpoint with repeated parameters. Check web server logs for unusual JavaScript execution or unexpected redirects. Use tools like Burp Suite or OWASP ZAP to intercept and inspect OAuth2 authorization requests for unencoded parameters.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to session hijacking, where attackers steal active user sessions. It may also redirect victims to phishing pages, enabling credential theft or further exploitation. Attackers can act within existing sessions or manipulate users into executing malicious actions without authentication.

Useful 0 Not Useful 0

Compliance Impact

This reflected XSS vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Attackers may steal session tokens or inject malicious scripts to exfiltrate data, compromising confidentiality and integrity of user sessions.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenAM to version 16.1.3 or later. As a temporary measure, implement a Content-Security-Policy to block inline scripts, restrict access to the /oauth2/authorize endpoint, or deploy a web application firewall to block requests with suspicious characters.

Useful 0 Not Useful 0