EUVD-2026-78365
GHSA-vqxv-6xrh-49cp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Reflected XSS with user interaction; no auth needed; scope changed.
Primary rating from Vendor (https://github.com/OpenIdentityPlatform/OpenAM).
CVSS VectorVendor: https://github.com/OpenIdentityPlatform/OpenAM
Lifecycle Timeline
2DescriptionCVE.org
Description
The OAuth2/OIDC consent page rendered for display=wap authorize requests reflected several request-derived values into the HTML response without escaping. An attacker who induces a user with an active OpenAM session to follow a crafted authorize link can execute arbitrary JavaScript in the OpenAM origin.
This is the same vulnerability class as CVE-2026-44203; that fix did not cover this code path.
Impact
Arbitrary JavaScript execution in the OpenAM origin in the victim's authenticated context - enabling session/cookie theft, CSRF-token exfiltration, and actions on behalf of the victim, up to administrative takeover if the victim is an administrator. Reachable on any deployment with at least one registered OAuth2 client; no attacker-controlled client and no special configuration required.
Mitigation
- Upgrade to 16.1.2 (or later).
- Until then, restrict/limit access to the OAuth2 authorize endpoint and treat unsolicited
display=wapauthorize links as untrusted.
AnalysisAI
Reflected XSS in OpenAM's OAuth2/OIDC consent page allows attackers to execute arbitrary JavaScript in the victim's authenticated session, enabling session theft and administrative takeover. Affects OpenAM versions 13.0.0 through 16.1.1. No active exploitation confirmed, but the attack vector is straightforward and publicly documented.
Technical ContextAI
The vulnerability exists in the OAuth2/OIDC consent page rendered for display=wap (Wireless Application Protocol) authorize requests. The page uses Apache FreeMarker templates to reflect request parameters such as r, target, response_type, and client_id into the HTML response without proper escaping, a classic CWE-79 Cross-site Scripting (XSS) flaw. The affected package is the openam-oauth2 Maven module (pkg:maven/org.openidentityplatform.openam:openam-oauth2). The fix introduces ?html escaping in the FreeMarker template and sanitizes scope descriptions to prevent injection.
RemediationAI
Upgrade to OpenAM version 16.1.2 or later, which includes the commit 98cee2dfe701c2e16e5bcee34e6fd9d913925118. As a workaround, restrict access to the OAuth2 authorize endpoint to trusted networks and educate users to avoid clicking unsolicited display=wap authorize links. If the WAP consent page is not required, consider disabling the display=wap parameter handling at the web application firewall or reverse proxy level. Note that disabling the WAP feature may break legitimate mobile clients relying on it.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today