CVE-2026-105116CWE-79cross-site-scripting

CVE-2026-105116

Medium · published October 3, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
4.2
In the wild
Unconfirmed
What it is

OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce auto-submit page. If reachable with cookieHashRedirectEnabled set, crafted requests could execute script in the OpenAM origin, though an unrelated HTTP 500 failure prevents exploitation in released versions.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00155 · 4.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-10-03T18:16Z
References (2)
https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-v796-mg6j-9c5m · [email protected]https://www.vulncheck.com/advisories/openam-before-16.1.3-latent-xss-in-saml-load-balancer-cookie-bounce-page · [email protected]
EPSS history
Timeline
  • 07 OCT 03:39Z
    EPSS moved — → 0%
    epss
  • 03 OCT 12:14Z
    OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page
    cvelistv5