CVE-2026-44203CWE-79cross-site-scripting

CVE-2026-44203

published September 15, 2026

CVSS
8.3
EPSS
1%
Percentile
47.7
In the wild
Unconfirmed
What it is

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the form_post response mode. An unauthenticated attacker can induce a user to open a crafted authorization request and execute script in the OpenAM origin. This issue is fixed in version 16.1.1.

The record
Technical detail
CVSS
8.3 · NONE
CVSS v4.0
8.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N
EPSS
0.00593 · 47.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-15T14:17Z
References (3)
https://github.com/OpenIdentityPlatform/OpenAM/commit/078bd4754905f5130eaa7bbe45f958eaeb7fd0d7 · [email protected]https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1 · [email protected]https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-fq9h-c788-fx73 · [email protected]
EPSS history
Timeline
  • 16 SEP 04:27Z
    EPSS moved — → 1%
    epss
  • 15 SEP 09:48Z
    OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)
    cvelistv5