~ / search / GHSA-fq9h-c788-fx73

GHSA-fq9h-c788-fx73

OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

Source: GitHub Advisory Database (reviewed) High CVE-2026-44203

Packages

EcosystemPackageAffectedFixed in
Maven org.openidentityplatform.openam:openam-oauth2 >= 13.0.0, < 16.1.1 16.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary The OAuth 2.0 / OpenID Connect authorization endpoint does not sufficiently sanitize certain user-supplied parameters before incorporating them into the HTML response generated for the `form_post` response mode. This may allow an attacker to inject content into the rendered page in the context of the OpenAM origin.

References

External links from the advisory. They lead to third-party sites.