CVE-2026-44793 in OpenAM
Summary
by MITRE • 09/15/2026
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can induce a user to follow a crafted request and execute script in the OpenAM origin. This issue is fixed in version 16.1.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified affects ForgeRock Access Management, formerly known as OpenAM, specifically within its federation endpoints prior to version 16.1.1. The core technical flaw stems from an inconsistency in how user-supplied parameters are encoded when rendered into HTML during the SAML2 cluster cookie-hash redirect process. In a non-default clustered configuration, these endpoints fail to properly sanitize or encode input data before embedding it within the response payload. This lack of proper encoding allows malicious scripts to be injected directly into the context where they will be executed by the victim's web browser. The issue is particularly insidious because it occurs during standard authentication and federation flows, making it difficult for users to distinguish between legitimate application behavior and a malicious attack vector without specialized security monitoring tools.
From an operational perspective, this vulnerability enables Cross-Site Scripting attacks against unauthenticated attackers who can craft specific requests designed to exploit the encoding flaw. By inducing a user with valid credentials or access privileges to follow a crafted link, an attacker can execute arbitrary JavaScript in the context of the OpenAM origin. This execution environment grants the malicious script significant power, including the ability to steal session cookies, capture sensitive authentication tokens, perform actions on behalf of the victim, and potentially pivot into other internal systems that trust the OpenAM identity provider. The impact is severe because it compromises the integrity of the access management solution itself, which serves as a critical gatekeeper for enterprise applications and data resources.
The technical classification of this flaw aligns with CWE-79, commonly known as Improper Neutralization of Input During Web Page Generation, or Cross-site Scripting (XSS). The specific mechanism involves reflected XSS where the malicious payload is embedded in the redirect path parameters that are subsequently rendered into HTML without adequate encoding. In terms of offensive security frameworks, this vulnerability maps to MITRE ATT&CK technique T1059, specifically Command and Scripting Interpretation via JavaScript, which falls under the broader category of Execution tactics. Attackers leverage this capability to establish persistence or escalate privileges within the web application environment by manipulating client-side scripts that run with trusted origin permissions.
Mitigation strategies primarily involve upgrading the OpenAM software to version 16.1.1 or later, where the encoding inconsistency in the SAML2 cluster cookie-hash redirect path has been corrected. For organizations unable to immediately patch their systems due to operational constraints, implementing a Web Application Firewall can provide an additional layer of defense by filtering out requests containing known XSS payloads or malformed parameters that trigger the vulnerability. Security teams should also audit federation endpoint configurations and ensure that all user-supplied data is rigorously validated and encoded before being rendered in any HTML context. Regular security assessments and penetration testing focused on authentication flows are recommended to detect similar encoding flaws across other endpoints within the access management infrastructure.