OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
Description
The OAuth2/OIDC consent page rendered for display=wap authorize requests reflected several request-derived values into the HTML response without escaping. An attacker who induces a user with an active OpenAM session to follow a crafted authorize link can execute arbitrary JavaScript in the OpenAM origin.
This is the same vulnerability class as CVE-2026-44203; that fix did not cover this code path.
Impact
Arbitrary JavaScript execution in the OpenAM origin in the victim's authenticated context — enabling session/cookie theft, CSRF-token exfiltration, and actions on behalf of the victim, up to administrative takeover if the victim is an administrator. Reachable on any deployment with at least one registered OAuth2 client; no attacker-controlled client and no special configuration required.
Mitigation
- Upgrade to 16.1.2 (or later).
- Until then, restrict/limit access to the OAuth2 authorize endpoint and treat unsolicited
display=wapauthorize links as untrusted.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.openidentityplatform.openam:openam-oauth2 | >= 13.0.0, < 16.1.2 | 16.1.2 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-79- Platform
- Java / Kotlin (Maven)
- Package
org.openidentityplatform.openam:openam-oauth2- Disclosed
- 24.07.2026
- Updated
- 11.10.2026 12:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-vqxv-6xrh-49cp - CC BY 4.0
Vulnerability history: org.openidentityplatform.openam:openam-oauth2
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 7
- First → latest
- 07.2024 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 4
- Medium 2
Disclosures per year
- 2024: 1
- 2025: 1
- 2026: 5
-
OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.