CVE-2026-105114 in OpenAM
Summary
by MITRE • 10/03/2026
OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeated parameters to run JavaScript in the OpenAM origin, acting within existing sessions or redirecting to phishing pages.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified in ForgeRock Access Manager versions prior to 16.1.3 represents a significant security flaw classified as an unvalidated reflection of user input into web content. This specific instance is categorized under CWE-79, which denotes Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting or XSS. The root cause lies in the application's handling of query parameters within the OAuth2 authorization endpoint. When an authentication attempt fails or encounters an error during the OAuth2 flow, the system generates a response page that includes details about the failure. In vulnerable versions, certain parameters passed by the client are rendered directly into the HTML output without adequate encoding or sanitization. This lack of proper input validation allows malicious actors to inject executable JavaScript code into the context of the OpenAM origin domain.
From an operational perspective, this reflected XSS vulnerability poses a severe risk because it does not require prior authentication. An attacker can craft a deceptive URL containing specially constructed parameters designed to trigger the execution of arbitrary scripts when accessed by a victim. The attack vector typically involves social engineering tactics where the victim is lured into clicking a malicious link pointing to the /oauth2/authorize endpoint with embedded payloads. Because the script executes within the security context of the OpenAM domain, it inherits all privileges associated with that origin. This capability enables attackers to perform session hijacking by stealing sensitive cookies or tokens stored in the browser's local storage for active sessions. Furthermore, the vulnerability can be leveraged to redirect users to phishing pages designed to harvest credentials from unsuspecting individuals who believe they are interacting with a legitimate authentication portal.
The impact of this flaw extends beyond simple script execution. By acting within existing authenticated sessions, an attacker could potentially manipulate administrative interfaces or access protected resources if the victim holds elevated privileges. The ability to redirect traffic also facilitates broader phishing campaigns that compromise user identities across integrated systems relying on OpenAM for single sign-on and identity management. This aligns with several techniques observed in the MITRE ATT&CK framework, particularly T1059 which covers Command and Scripting Interpreter execution via browser-based mechanisms, and T1566 which encompasses Phishing through spearphishing links that lead to credential harvesting sites. The unauthenticated nature of this exploit makes it particularly dangerous as it lowers the barrier for entry significantly compared to authenticated vulnerabilities.
Mitigation strategies must prioritize immediate patching to version 16.1.3 or later where these input validation issues have been addressed by implementing strict output encoding and parameter sanitization routines. For environments where upgrading is not immediately feasible, network-level controls such as Web Application Firewalls can be configured to detect and block requests containing known XSS payloads in the query string of OAuth2 endpoints. Additionally, enforcing Content Security Policy headers that restrict script execution sources can provide a layer of defense by preventing inline scripts from running even if they are injected into the page. Regular security audits focusing on input handling across all authentication flows are essential to ensure that similar reflection points do not exist elsewhere in the application architecture.