O
Vendor security profile
openidentityplatform
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs30
Critical9
CISA KEV0
Public exploit1
Patch rate%10
Avg. CVSS7.5
12-month vulnerability rate
0
0
0
0
0
1
0
0
0
1
19
9
CVE KEV
CVE severity distribution
30toplam CVE
Critical9 (30%)
High12 (40%)
Medium8 (27%)
Low1 (3%)
Patch and exploitation view
%10
Verified patch
%0
CISA KEV
%3
Public exploit
3Patch available
0Partial
0Workaround
0Vendor: no patch
27Unknown
Latest vulnerabilities
5.3
CVE-2026-105122
OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri
O
Patch status unknownEPSS %0
6.9
CVE-2026-105121
OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping
O
Patch status unknownEPSS %0
6.9
CVE-2026-105120
OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint
O
Patch status unknownEPSS %0
7.6
CVE-2026-105119
OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows
O
Patch status unknownEPSS %0
2.3
CVE-2026-105118
OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession
O
Patch status unknownEPSS %0
5.3
CVE-2026-105117
OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions
O
Patch status unknownEPSS %0
5.1
CVE-2026-105116
OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page
O
Patch status unknownEPSS %0
8.8
CVE-2026-105115
OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface
O
Patch status unknownEPSS %0
5.3
CVE-2026-105114
OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page
O
Patch status unknownEPSS %0
9.2
CVE-2026-46495
OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI
O
Patch status unknownEPSS %1