GHSA-vqxv-6xrh-49cp

Suggest an improvement
Source
https://github.com/advisories/GHSA-vqxv-6xrh-49cp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-vqxv-6xrh-49cp/GHSA-vqxv-6xrh-49cp.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vqxv-6xrh-49cp
Aliases
Published
2026-07-24T21:09:36Z
Modified
2026-07-24T21:26:41Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
Details

Description

The OAuth2/OIDC consent page rendered for display=wap authorize requests reflected several request-derived values into the HTML response without escaping. An attacker who induces a user with an active OpenAM session to follow a crafted authorize link can execute arbitrary JavaScript in the OpenAM origin.

This is the same vulnerability class as CVE-2026-44203; that fix did not cover this code path.

Impact

Arbitrary JavaScript execution in the OpenAM origin in the victim's authenticated context — enabling session/cookie theft, CSRF-token exfiltration, and actions on behalf of the victim, up to administrative takeover if the victim is an administrator. Reachable on any deployment with at least one registered OAuth2 client; no attacker-controlled client and no special configuration required.

Mitigation

  • Upgrade to 16.1.2 (or later).
  • Until then, restrict/limit access to the OAuth2 authorize endpoint and treat unsolicited display=wap authorize links as untrusted.
Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-24T21:09:36Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

Maven / org.openidentityplatform.openam:openam-oauth2

Package

Name
org.openidentityplatform.openam:openam-oauth2
View open source insights on deps.dev
Purl
pkg:maven/org.openidentityplatform.openam/openam-oauth2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
13.0.0
Fixed
16.1.2

Affected versions

14.*
14.5.2
14.5.3
14.5.4
14.6.1
14.6.2
14.6.3
14.6.4
14.6.5
14.6.6
14.7.0
14.7.1
14.7.2
14.7.3
14.7.4
14.8.1
14.8.2
14.8.3
14.8.4
15.*
15.0.0
15.0.1
15.0.2
15.0.3
15.0.4
15.1.0
15.1.1
15.1.2
15.1.3
15.1.4
15.1.5
15.1.6
15.2.0
15.2.1
15.2.2
16.*
16.0.1
16.0.2
16.0.3
16.0.4
16.0.5
16.0.6
16.1.0
16.1.1

Database specific

last_known_affected_version_range 
"<= 16.1.1"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-vqxv-6xrh-49cp/GHSA-vqxv-6xrh-49cp.json"