How to fix or mitigate EUVD-2026-78356?

Within 24 hours: Identify all deployed OpenAM instances and determine whether versions 13.0.0-16.1.0 are in use; disable form_post response mode if operationally feasible as a temporary control. Within 7 days: Deploy Web Application Firewall (WAF) rules to detect and block reflected XSS payloads targeting the authorization endpoint; implement strict input validation and output encoding for user-supplied parameters (state, etc.). Within 30 days: Assess upgrade paths to OpenAM versions beyond 16.1.0 or evaluate migration to actively maintained identity platforms; no public exploit identified at time of analysis, but CVSS 9.3 severity mandates urgent action.

EUVD-2026-78356

Q: What is the CVSS score of EUVD-2026-78356?

EUVD-2026-78356 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

| CVE-2026-44203 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-22 https://github.com/OpenIdentityPlatform/OpenAM

GHSA-fq9h-c788-fx73

XSS

8.3

CVSS 4.0 · Vendor: https://github.com/OpenIdentityPlatform/OpenAM

Severity by source

Vendor (https://github.com/OpenIdentityPlatform/OpenAM) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Pre-auth reflected XSS reachable over the network (AV:N/AC:L/PR:N), needs victim click (UI:R), and script in OpenAM origin compromises federated sessions for other apps (S:C, C:H/I:H, A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (https://github.com/OpenIdentityPlatform/OpenAM).

CVSS VectorVendor: https://github.com/OpenIdentityPlatform/OpenAM

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Sep 15, 2026 - 10:34 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 15, 2026 - 10:22 vuln.today

cvss_changed

Severity Changed

Sep 15, 2026 - 10:22 NVD

CRITICAL HIGH

CVSS changed

Sep 15, 2026 - 10:22 NVD

9.3 (CRITICAL) 8.3 (HIGH)

Source Code Evidence Fetched

Jun 22, 2026 - 20:31 vuln.today

Analysis Generated

Jun 22, 2026 - 20:31 vuln.today

DescriptionCVE.org

Summary

The OAuth 2.0 / OpenID Connect authorization endpoint does not sufficiently sanitize certain user-supplied parameters before incorporating them into the HTML response generated for the form_post response mode. This may allow an attacker to inject content into the rendered page in the context of the OpenAM origin.

AnalysisAI

Reflected cross-site scripting in the OpenAM OAuth 2.0 / OpenID Connect authorization endpoint allows an unauthenticated attacker to inject HTML and JavaScript into the form_post response page rendered in the OpenAM origin by manipulating the OAuth state parameter. The flaw affects the openam-oauth2 module of org.openidentityplatform.openam from version 13.0.0 up to (but not including) 16.1.1, and is fixed in the 16.1.1 release. No public exploit code and no CISA KEV listing were identified at time of analysis, but the vulnerable templates are shipped by default and the injection point is a standard, client-controllable OAuth parameter.