https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 01:20:02 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-370484 EUVD-2026-370484 https://cve.radiocsirt.org/vuln/euvd-2026-370484 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44203 <p>Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the form_post response mode. An unauthenticated attacker can induce a user to open a crafted authorization request and execute script in the OpenAM origin. This issue is fixed in version 16.1.1.</p> <p>Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the form_post response mode. An unauthenticated attacker can induce a user to open a crafted authorization request and execute script in the OpenAM origin. This issue is fixed in version 16.1.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44203 https://cve.radiocsirt.org/vuln/ghsa-fq9h-c788-fx73 <p><strong>Affected:</strong> Maven: org.openidentityplatform.openam:openam-oauth2</p> <p>### Summary</p> <p>The OAuth 2.0 / OpenID Connect authorization endpoint does not sufficiently sanitize certain user-supplied parameters before incorporating them into the HTML response generated for the `form_post` response mode. This may allow an attacker to inject content into the rendered page in the context of the OpenAM origin.</p> <p><strong>Affected:</strong> Maven: org.openidentityplatform.openam:openam-oauth2</p> <p>### Summary</p> <p>The OAuth 2.0 / OpenID Connect authorization endpoint does not sufficiently sanitize certain user-supplied parameters before incorporating them into the HTML response generated for the `form_post` response mode. This may allow an attacker to inject content into the rendered page in the context of the OpenAM origin.</p> https://cve.radiocsirt.org/vuln/ghsa-fq9h-c788-fx73 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44203 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: openam</p> <p>Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the form_post response mode. An unauthenticated attacker can induce a user to open a crafted authorization request and execute script in the OpenAM origin. This issue is fixed in version 16.1.1.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: openam</p> <p>Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the form_post response mode. An unauthenticated attacker can induce a user to open a crafted authorization request and execute script in the OpenAM origin. This issue is fixed in version 16.1.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44203