CVE-2026-62280 in OpenAM
Summary
by MITRE • 09/15/2026
Open Access Management (OpenAM) is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an active OpenAM session to follow a crafted authorization link and execute JavaScript in the OpenAM origin, enabling session or cookie theft, CSRF-token disclosure, and actions with the victim's privileges. At least one registered OAuth2 client is required, but the attacker does not need to control that client. This issue is fixed in version 16.1.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within Open Access Management versions ranging from 13.0.0 through 16.1.2 represents a critical cross-site scripting flaw located specifically at the OAuth2 authorize endpoint. The core technical deficiency lies in the handling of request-derived values during the consent process, particularly when the display parameter is set to wap for mobile or embedded contexts. In these scenarios, the system utilizes templates such as ConsentRequiredResource and wap/authorize.ftl to render user interface elements that reflect input parameters directly into the HTML output without applying proper encoding or escaping mechanisms. This lack of sanitization allows maliciously crafted strings within authorization requests to be interpreted as executable code by the victim's web browser rather than being treated as inert text data, fundamentally breaking the isolation between content and execution expected in modern web applications.
From an operational perspective, this flaw enables a stored or reflected cross-site scripting attack vector that can be exploited without requiring the attacker to control any registered OAuth2 client application, although at least one valid client must exist within the OpenAM configuration for the flow to proceed. An adversary can construct a deceptive authorization link containing malicious JavaScript payloads embedded in query parameters designed to trigger when the victim interacts with the consent page. When an authenticated user clicks this crafted link and proceeds through the authentication workflow, their browser executes the injected script within the security context of the OpenAM origin. This domain-level execution grants the attacker significant leverage over the session environment, bypassing same-origin policy protections that would otherwise restrict access to sensitive resources.
The consequences of successful exploitation are severe and multifaceted, primarily centering on credential theft and privilege escalation via session hijacking. By executing arbitrary JavaScript in the OpenAM context, an attacker can extract critical security artifacts such as authentication cookies, which may allow for complete account takeover if the cookies lack appropriate secure or http-only flags or if they remain valid after logout. Furthermore, the attack facilitates the disclosure of CSRF tokens used by the application to prevent cross-site request forgery attacks on subsequent actions. With access to these tokens and session identifiers, an attacker can impersonate the victim not only within OpenAM but potentially in downstream applications that rely on SSO or token-based authentication mechanisms linked to this identity provider. This effectively allows unauthorized administrative changes, data exfiltration, or further lateral movement across integrated systems trusting the compromised session.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as a common cause for cross-site scripting flaws. In terms of offensive security frameworks, it maps to MITRE ATT&CK technique T1059, specifically command and script interpretation via browser-based execution, and supports the initial access or credential harvesting phases depending on whether the attack is used to gain entry or steal existing credentials. The exploitation path also relates to CWE-642 regarding external control of critical state data through unvalidated input parameters in authentication flows.
To mitigate this risk immediately for systems running affected versions, administrators should apply the vendor-provided patch available in version 16.1.2 and later releases where the rendering logic has been corrected to properly escape user-supplied input before inclusion in HTML responses. For environments unable to upgrade instantly due to compatibility constraints or operational downtime requirements, implementing a Web Application Firewall rule set that detects and blocks script injection patterns within OAuth authorization parameters can provide temporary protection. Additionally, ensuring that all cookies associated with the OpenAM session are configured with HttpOnly, Secure, and SameSite attributes significantly reduces the impact of any successful cookie theft by preventing client-side scripts from accessing sensitive token data and restricting cross-site request submission respectively. Regular auditing of input validation practices across authentication endpoints is also recommended to prevent similar injection vulnerabilities in other parts of the access management infrastructure.