Security Advisories · OpenIdentityPlatform/OpenAM · GitHub

Security Advisories

View known security vulnerabilities and report new vulnerabilities privately to maintainers.

Report a vulnerability

OpenAM: Unauthenticated Remote Code Execution via unsafe class instantiation in the /authservice (PLL) endpoint
GHSA-wg5r-wc3x-39vc published Jul 23, 2026 by vharseko

Critical
OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
GHSA-vqxv-6xrh-49cp published Jul 23, 2026 by vharseko

Moderate
OpenAM WebAuthn Java deserialization RCE via ObjectInputFilter depth
GHSA-gf8h-gq53-288j published Jul 23, 2026 by vharseko

High
OpenAM Groovy script sandbox escape leads to authenticated RCE
GHSA-5hgj-6j53-p729 published Jul 22, 2026 by vharseko

Critical
OpenAM Open Redirect in SAML2/IDFF IDP Discovery Endpoints
GHSA-2pf8-52jh-5x3m published Jul 22, 2026 by vharseko

Moderate
OpenAM Insecure SSO Cookie Initialization
GHSA-fpmh-vx4h-xc33 published Jun 29, 2026 by vharseko

Moderate
OpenAM OAuth Authorization Bypass via PKCE Challenge
GHSA-4v2w-2wqp-mc85 published Jun 28, 2026 by vharseko

Moderate
OpenAM OAuth Client Impersonation via JWKS Resolver Cache
GHSA-f2cx-463q-7m2c published Jun 28, 2026 by vharseko

High
OpenAM Authenticated RCE via Groovy Sandbox Escape
GHSA-69j4-qvqr-hpw3 published Jun 27, 2026 by vharseko

High
OpenAM Account Takeover via OAuth2 Unverified Password Change
GHSA-gf57-4mp6-m85x published Jun 26, 2026 by vharseko

High