CVE-2026-105114 — OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page
OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unen…
Published: 2026-10-03 · CVSS: 5.3 · CVSS 4.0
OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeated parameters to run JavaScript in the OpenAM origin, acting within existing sessions or redirecting to phishing pages.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7