Low severityNVD Advisory· Published Jun 22, 2026
OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`
CVE-2026-44793
Description
Summary
Certain federation endpoints do not consistently apply output encoding when rendering user-supplied parameters into HTML responses. Under a non-default configuration used in some clustered deployments, this inconsistency can result in reflected XSS in the OpenAM origin without authentication.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.openidentityplatform.openam:openam-federation-libraryMaven | < 16.1.1 | 16.1.1 |
Affected products
1Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.