OpenIdentityPlatform vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20241
3. 20252
4. 202650

Newest CVEs

• CVE-2026-123553

  OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login

  OpenIdentityPlatform · OpenAM

  Medium6.9
• CVE-2026-123552

  OpenAM before 16.1.4 SSRF and CRL Tampering via Certificate CRL Distribution Point

  OpenIdentityPlatform · OpenAM

  Medium6.3
• CVE-2026-123551

  OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket

  OpenIdentityPlatform · OpenAM

  Critical10.0
• CVE-2026-123550

  OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions

  OpenIdentityPlatform · OpenAM

  Critical9.3
• CVE-2026-123549

  OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass

  OpenIdentityPlatform · OpenAM

  Critical9.3
• CVE-2026-123548

  OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages

  OpenIdentityPlatform · OpenAM

  Low2.3
• CVE-2026-123547

  OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState

  OpenIdentityPlatform · OpenAM

  Low2.3
• CVE-2026-123546

  OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFail

  OpenIdentityPlatform · OpenAM

  Medium5.3
• CVE-2026-123545

  OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow

  OpenIdentityPlatform · OpenAM

  High7.1
• CVE-2026-123544

  OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel

  OpenIdentityPlatform · OpenAM

  Medium6.1