CVE-2026-123539

OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that allows privileged attackers to inject script by placing markup in a user's display name. When the victim reaches the OAuth 2.0 / OpenID Connect consent page, the unencoded name executes script that can steal the OpenAM session cookie to impersonate the user.

Referanslar

• https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-v6hq-3cfh-5gr6
• https://www.vulncheck.com/advisories/openam-before-16.1.4-stored-xss-via-oauth-2.0-consent-page-display-name