Vulnerabilities in OpenIdentityPlatform
36 resultsCVE-2026-33439CRITICALPre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAMEPSS 9.3%CVE-2024-41667HIGHOpenAM FreeMarker template injectionEPSS 3.5%CVE-2023-37471CRITICALUser impersonation using SAMLv1.x SSO in Open Access Management EPSS 1.3%CVE-2026-46495CRITICALOpenDJ Pre-Auth RCE via Java Deserialization in JMX RMIEPSS 1.1%CVE-2026-62379CRITICALOpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallbackEPSS 1.1%CVE-2026-46619CRITICALOpenAM Authentication Bypass via MSISDN LDAP InjectionEPSS 1.0%CVE-2026-62263CRITICALOpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypassEPSS 0.9%CVE-2026-45052CRITICALOpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery EndpointsEPSS 0.8%CVE-2026-45051CRITICALOpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator StorageEPSS 0.7%CVE-2026-46623HIGHOpenAM Account Takeover via Unverified Password Change in OAuth2 ModuleEPSS 0.7%CVE-2026-45794HIGHOpenAM Unsafe Java Deserialization via SNSEPSS 0.6%CVE-2026-44203HIGHOpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)EPSS 0.6%CVE-2026-44793HIGHOpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`EPSS 0.6%CVE-2026-47426HIGHOpenAM OAuth Client Impersonation via JWKS Resolver CacheEPSS 0.6%CVE-2026-48717CRITICALOpenAM OAuth Authorization Bypass via PKCE ChallengeEPSS 0.5%CVE-2026-41573HIGHOpenAM LDAP Injection via `_queryId` ParameterEPSS 0.5%CVE-2026-47424HIGHOpenAM Authenticated RCE via Groovy Sandbox EscapeEPSS 0.5%CVE-2026-105115HIGHOpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC InterfaceEPSS 0.5%CVE-2026-45048HIGHOpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPCEPSS 0.4%CVE-2026-46498HIGHOpenAM Arbitrary OAuth Token Minting via Push RegistrationEPSS 0.4%