GHSA-fhrq-3gmx-p879
OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`
At a glance
- Published
- Updated
- CVE
- CVE-2026-44793
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Description
## Summary Certain federation endpoints do not consistently apply output encoding when rendering user-supplied parameters into HTML responses. Under a non-default configuration used in some clustered deployments, this inconsistency can result in reflected XSS in the OpenAM origin without authentication.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.openidentityplatform.openam:openam-federation-library | introduced 0, fixed 16.1.1 |
References
- https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-fhrq-3gmx-p879 WEB
- https://github.com/OpenIdentityPlatform/OpenAM PACKAGE
- https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |