CVE-2026-44793

Open Access Management (OpenAM) versions prior to 16.1.1 contain a reflected cross-site scripting flaw (CWE-79) in certain federation endpoints that are active only in a non-default clustered configuration, where user-supplied parameters are inconsistently HTML-encoded in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker crafts a malicious link or request and induces a victim to follow it, causing attacker-supplied script to execute in the victim's browser under the trusted OpenAM origin. Successful exploitation can yield high integrity impact on the web content of the OpenAM instance and its downstream SSO context — for example, tampering with authentication flows or acting on the victim's authenticated session — though the attack requires user interaction and is limited to deployments with the vulnerable clustered setup. The issue is rated high severity (CVSS 4.0: 7.0) and is fixed in OpenAM 16.1.1. There is no known public proof of concept, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Upgrade OpenAM to version 16.1.1, which fixes the flaw. If immediate patching is not possible, verify whether you run a clustered configuration with SAML2 federation enabled (the vulnerable path is inactive in default deployments), and restrict or gateway access to the affected federation endpoints. Additionally, inspect web access logs for unsolicited requests to SAML2 redirect endpoints containing HTML/script syntax in parameters, and consider a WAF rule to block script payloads in those redirect parameters until upgraded.