OpenAM CVE-2026-105114

Exploitation requires the OAuth2 authorization endpoint (/oauth2/authorize) to be enabled and reachable - a standard, commonly-deployed OpenAM feature - and requires the attacker to supply crafted repeated/duplicated query parameters that trigger the unencoded error page. The key LIMITING factor is mandatory user interaction (UI:P): a victim must click the attacker-supplied link, and the highest-value impact (session riding) requires that the victim already have an active OpenAM session. No authentication is required of the attacker (PR:N), and default configurations exposing the OAuth2 endpoint are affected on OpenAM versions before 16.1.3.

This is a genuine but moderate-severity issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P) confirms network-reachable, low-complexity, unauthenticated exploitation but critically requires passive user interaction (UI:P) - a victim must be lured into clicking a crafted /oauth2/authorize link, which caps real-world impact and matches the Low confidentiality/integrity sub-scores. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no evidence of active or at-scale exploitation. The primary value of this bug to an attacker is session-riding within the OpenAM origin and credential phishing against an identity-management surface - which raises the stakes above a typical marketing-site XSS, since OpenAM is a trust anchor for SSO. Net: prioritize patching because the affected component is a security-critical IAM system, but treat urgency as moderate given the required user interaction and absence of exploitation signals. No conflicting signals in the data, though the limiting UI requirement should temper any raw-score-driven ranking.

An attacker crafts a malicious /oauth2/authorize URL with repeated/duplicated parameters that get reflected unencoded onto the OAuth2 authorization error page, then delivers it to a victim via phishing email or a malicious link. When the authenticated victim clicks it, attacker-controlled JavaScript executes in the OpenAM origin, allowing session abuse or redirection to a credential-harvesting page. No public exploit code was identified at time of analysis, though the vendor/VulnCheck advisory describes the technique in detail.