CVE-2026-44203

Open Access Management (OpenAM) versions prior to 16.1.1 fail to properly encode user-supplied parameters before the FormPostResponse.ftl and checkSession.ftl FreeMarker templates render them into HTML for the OAuth 2.0/OpenID Connect form_post response mode. An unauthenticated attacker can craft a malicious authorization request and induce a victim to open it, causing attacker-controlled script to execute in the victim's browser under the OpenAM origin. Because OpenAM is an identity provider, successful exploitation can let the attacker hijack sessions, steal tokens or credentials, or tamper with authentication flows on the affected deployment. Any organization self-hosting OpenAM older than 16.1.1 that exposes the OAuth 2.0/OIDC authorization endpoint is affected. The flaw is fixed in version 16.1.1; there is no known public proof of concept and the issue is not on the CISA KEV catalog.

What to do: Upgrade OpenAM to version 16.1.1 or later, which fixes the encoding flaw in the form_post response templates. Until the upgrade is complete, consider blocking or restricting the form_post response mode for OAuth 2.0/OIDC clients, and apply WAF rules to filter HTML/script payloads in authorization request parameters. Review authorization endpoint logs for crafted requests containing markup in state, redirect_uri, or other user-supplied parameters that could indicate exploitation attempts.