Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
CVE-2026-44203 Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encod… https://www.cve.org/CVERecord?id=CVE-2026-44203
🚨Critical - OpenAM Pre-Auth Reflected XSS in OAuth2/OIDC form_post Response (CVE-2026-44203) OpenAM's OAuth 2.0 / OpenID Connect authorization endpoint fails to sufficiently sanitize user-supplied parameters such as state before placing them into the HTML response generated for response_mode=form_post (FormPostResponse.ftl). An attacker can inject script that runs in the context of the OpenAM origin. The flaw is pre-authentication and requires only that a victim follow a crafted link. Since OpenAM is an SSO / identity provider, executing script in its origin can be used to steal sessions and tokens and abuse authentication flows, with high confidentiality and integrity impact and a scope change. 👉Upgrade to OpenAM 16.1.1.
Post summary
The post announces a critical pre-auth XSS vulnerability (CVE-2026-44203) in OpenAM’s OAuth2/OIDC form_post response and urges users to upgrade to OpenAM 16.1.1 to mitigate the issue.