Vulnerabilidades en OpenIdentityPlatform
25 resultadosAnálisis Vexday
A OpenIdentityPlatform apresenta um panorama de risco moderado com 5 vulnerabilidades documentadas, sendo 2 críticas, todas relacionadas a falhas de autenticação (CWE-287). Nenhuma das vulnerabilidades está atualmente sob ataque ativo e não há registros de novos problemas nos últimos 90 dias, indicando um risco estabilizado, embora a fraqueza em mecanismos de autenticação demande monitoramento contínuo.
CVE-2026-33439CRITICALPre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAMEPSS 10.0%CVE-2024-41667HIGHOpenAM FreeMarker template injectionEPSS 3.5%CVE-2023-37471CRITICALUser impersonation using SAMLv1.x SSO in Open Access Management EPSS 1.3%CVE-2026-46495CRITICALOpenDJ Pre-Auth RCE via Java Deserialization in JMX RMIEPSS 0.7%CVE-2026-62379CRITICALOpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallbackEPSS 0.7%CVE-2026-46619CRITICALOpenAM Authentication Bypass via MSISDN LDAP InjectionEPSS 0.6%CVE-2026-62263CRITICALOpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypassEPSS 0.5%CVE-2026-45794HIGHOpenAM Unsafe Java Deserialization via SNSEPSS 0.5%CVE-2026-45051CRITICALOpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator StorageEPSS 0.5%CVE-2026-46623HIGHOpenAM Account Takeover via Unverified Password Change in OAuth2 ModuleEPSS 0.5%CVE-2026-44203HIGHOpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)EPSS 0.5%CVE-2026-44793HIGHOpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`EPSS 0.4%CVE-2026-47426HIGHOpenAM OAuth Client Impersonation via JWKS Resolver CacheEPSS 0.4%CVE-2025-27497HIGHOpenDJ Denial of Service (Dos) using alias loopEPSS 0.4%CVE-2026-41573HIGHOpenAM LDAP Injection via `_queryId` ParameterEPSS 0.4%CVE-2026-47424HIGHOpenAM Authenticated RCE via Groovy Sandbox EscapeEPSS 0.4%CVE-2026-45052CRITICALOpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery EndpointsEPSS 0.3%CVE-2026-53660HIGHOpenAM Insecure SSO Cookie InitializationEPSS 0.3%CVE-2025-64099HIGHOpenAM allows use of arbitrary OIDC requested claims values in id_token and user_infoEPSS 0.3%CVE-2026-48717CRITICALOpenAM OAuth Authorization Bypass via PKCE ChallengeEPSS 0.3%