GHSA-v6hq-3cfh-5gr6: OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display Name

Published Nov 8, 2026

Updated

OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that allows privileged attackers to inject script by placing markup in a user's display name. When the victim reaches the OAuth 2.0 / OpenID Connect consent page, the unencoded name executes script that can steal the OpenAM session cookie to impersonate the user.

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and when does the payload run?

Exploitation requires a privileged attacker who can place markup in a user's display name. The stored script executes when a victim reaches the OAuth 2.0 or OpenID Connect consent page.

What is the potential impact on an affected user?

The injected script can steal the victim's OpenAM session cookie, allowing the attacker to impersonate that user.

Which versions are affected?

OpenAM versions before 16.1.4 are affected.

GHSA-v6hq-3cfh-5gr6: OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display Name

Event History

Frequently Asked Questions

Who can exploit this issue, and when does the payload run?

What is the potential impact on an affected user?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and when does the payload run?

What is the potential impact on an affected user?

Which versions are affected?