All packages
OpenAM vulnerabilities
3 known CVE vulnerabilities in OpenAM, translated and rated.
- CVE-2016-10097High
OpenAM 10.1.0 has an XXE (XML External Entity) vulnerability in the path /SSOPOST/metaAlias/%realm%/idpv2, allowing remote attackers to read arbitrary files via the SAMLRequest parameter.
- CVE-2026-33439Critical
OpenAM prior to 16.0.6 is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter, bypassing the WhitelistObjectInputStream mitigation applied to jato.pageSession after CVE-2021-35464.
- CVE-2023-37471Critical
OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses in the SSO process, allowing attackers to impersonate any OpenAM user, including the administrator.