CVE-2026-62280

Open Access Management (OpenAM) is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an active OpenAM session to follow a crafted authorization link and execute JavaScript in the OpenAM origin, enabling session or cookie theft, CSRF-token disclosure, and actions with the victim's privileges. At least one registered OAuth2 client is required, but the attacker does not need to control that client. This issue is fixed in version 16.1.2.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62280.json"
}

References

Affected packages

Git / github.com/openidentityplatform/openam

Affected ranges

Type

GIT

Repo

https://github.com/openidentityplatform/openam

Events

Introduced

5d4589530d1353fdd627ab216a1cdcbcaf6b705e

Fixed

98cee2dfe701c2e16e5bcee34e6fd9d913925118

Fixed

73a64a20348d5448e0820469539c8af75f08d314

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "13.0.0"
        },
        {
            "fixed": "16.1.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

13.*

13.0.0

14.*

14.0.0

14.0.1

14.0.2

14.0.3

14.0.4

14.0.5

14.0.6

14.1.1

14.1.10

14.1.11

14.1.12

14.1.13

14.1.16

14.1.17

14.1.2

14.1.3

14.1.4

14.1.5

14.1.6

14.1.7

14.1.8

14.1.9

14.2.1

14.2.2

14.3.1

14.4.1

14.4.2

14.5.1

14.5.2

14.5.3

14.5.4

14.6.2

14.6.3

14.6.4

14.6.5

14.6.6

14.7.0

14.7.1

14.7.2

14.7.3

14.7.4

14.8.1

14.8.2

14.8.3

14.8.4

15.*

15.0.0

15.0.1

15.0.2

15.0.3

15.0.4

15.1.0

15.1.1

15.1.2

15.1.3

15.1.4

15.1.5

15.1.6

15.2.0

15.2.1

15.2.2

16.*

16.0.3

16.0.4

16.0.5

16.0.6

16.1.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62280.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "250119110513067752376481673881300415369",
                "79525766586887283935477140796236848678",
                "85314866589099926471898570754120017946",
                "115847194682671120613514137281887123576",
                "232717651091922779257349080809684398077",
                "27277628995475389109749419500204761649",
                "283668581191564368285692957095312677506",
                "181217993316632743371022843687753635912",
                "190166698603017458361677544764038907521",
                "212307634994656331417033230844666173698",
                "263843920206155861548136866097203343373",
                "55566155697178953129950701094559673464",
                "40183345844214199204112753819187363285"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-62280-119a212f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/98cee2dfe701c2e16e5bcee34e6fd9d913925118",
        "target": {
            "file": "openam-oauth2/src/main/java/org/forgerock/oauth2/restlet/ConsentRequiredResource.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "72813104269112907366834592532633840084",
            "length": 1392
        },
        "id": "CVE-2026-62280-82be234e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/openidentityplatform/openam/commit/98cee2dfe701c2e16e5bcee34e6fd9d913925118",
        "target": {
            "file": "openam-oauth2/src/main/java/org/forgerock/oauth2/restlet/ConsentRequiredResource.java",
            "function": "addDisplayScopesAndClaims"
        }
    }
]

vanir_signatures_modified

"2026-09-18T08:08:47Z"