Maven org.openidentityplatform.openam:openam-core
productUSpkg:maven/org.openidentityplatform.openam/openam-core
A product tracked in the threat graph; the vulnerabilities below are known to affect it.
0
KEV-listed
0
EPSS ≥ 10%
0
unpatched
0
critical
by severity
0critical0high1medium0low
updated 2026-10-30
01
vulnerabilities (5)
Related CVEs.
| ID | severity | exploitable | ||||
|---|---|---|---|---|---|---|
| CVE-2022-34298US | medium5.3OT elevated | Exploit | ||||
The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack." | ||||||
| CVE-2026-62379US | — | — | ||||
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML element whose class… | ||||||
| CVE-2026-45048US | — | — | ||||
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege… | ||||||
| CVE-2026-44202US | — | — | ||||
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbi… | ||||||
| CVE-2026-53660US | —OT elevated | — | ||||
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie with HttpOnly disabled a… | ||||||
02
weaknesses (8)
The flaw types (CWEs) most of these CVEs share.
- CWE-1004Sensitive Cookie Without 'HttpOnly' Flag1 CVEs
- CWE-1188Initialization of a Resource with an Insecure Default1 CVEs
- CWE-1275Sensitive Cookie with Improper SameSite Attribute1 CVEs
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs
- CWE-285Improper Authorization1 CVEs
- CWE-470Use of Externally-Controlled Input to Select Classes or Code1 CVEs
- CWE-863Incorrect Authorization1 CVEs
- CWE-918Server-Side Request Forgery1 CVEs
03
sources (1)
Which sources assert this record, and when.
- USOSV.dev5 CVEs
scry
Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.
Free scan