pkg:Maven/org.openidentityplatform.openam:openam-oauth2

All known vulnerabilities

• CRITICAL9.3CVE-2026-44203OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)
  >= 13.0.0, < 16.1.1
• HIGH8.8CVE-2024-41667OpenAM FreeMarker template injection
  from 0, < 15.0.4
• —CVE-2026-48717OpenAM OAuth Authorization Bypass via PKCE Challenge
  from 0, < 16.1.1
• —OpenAM OAuth Client Impersonation via JWKS Resolver Cache
  from 0, < 16.1.1
• —OpenAM Arbitrary OAuth Token Minting via Push Registration
  from 0, < 16.1.1
• —OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed
  from 0, < 16.0.3