Is there a patch available for CVE-2026-44793?

Yes, a patch is available for CVE-2026-44793. Update the affected software to the latest version immediately.

CVE-2026-44793

Q: What is the CVSS score of CVE-2026-44793?

CVE-2026-44793 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-78351 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-22 https://github.com/OpenIdentityPlatform/OpenAM

GHSA-fhrq-3gmx-p879

XSS

7.0

CVSS 4.0 · Vendor: https://github.com/OpenIdentityPlatform/OpenAM

Severity by source

Vendor (https://github.com/OpenIdentityPlatform/OpenAM) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

AC:H because non-default clustered configuration is required; PR:N per advisory; UI:R and S:C are standard for reflected XSS with no server-side code execution.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (https://github.com/OpenIdentityPlatform/OpenAM).

CVSS VectorVendor: https://github.com/OpenIdentityPlatform/OpenAM

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Sep 15, 2026 - 10:34 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 15, 2026 - 10:22 vuln.today

cvss_changed

CVSS changed

Sep 15, 2026 - 10:22 NVD

7.0 (HIGH)

Source Code Evidence Fetched

Jun 22, 2026 - 21:21 vuln.today

Analysis Generated

Jun 22, 2026 - 21:21 vuln.today

DescriptionCVE.org

Summary

Certain federation endpoints do not consistently apply output encoding when rendering user-supplied parameters into HTML responses. Under a non-default configuration used in some clustered deployments, this inconsistency can result in reflected XSS in the OpenAM origin without authentication.

AnalysisAI

Reflected cross-site scripting in the federation endpoints of OpenIdentityPlatform OpenAM allows an unauthenticated attacker to inject script into the OpenAM origin by luring a victim to a crafted URL, but only when a non-default clustering configuration (the SAML2 cluster cookie-hash-redirect path handled by FSUtils.postToTarget) is in use. The flaw is an output-encoding inconsistency (CWE-79) in the openam-federation-library package, fixed in version 16.1.1 via upstream commit 2f5e9bf4. No public exploit code or CISA KEV listing was identified at time of analysis, and because execution runs in the trusted identity-provider origin, a successful attack can drive authenticated state-changing actions rather than merely steal a low-value session.