CVE-2026-105114: OpenAM OAuth2 Reflected XSS Vulnerability

CVE-2026-105114 Overview

CVE-2026-105114 is a reflected cross-site scripting (XSS) vulnerability in OpenAM versions prior to 16.1.3. The flaw resides in the OAuth2 authorization error page, which renders attacker-supplied parameters without proper output encoding. Unauthenticated attackers can craft a malicious /oauth2/authorize URL containing repeated parameters that cause JavaScript to execute in the OpenAM origin. Successful exploitation lets attackers act within existing authenticated sessions or redirect victims to phishing pages, undermining the identity trust boundary that OpenAM enforces.

Critical Impact
Attackers can execute arbitrary JavaScript in the OpenAM origin, enabling session abuse, credential theft via phishing redirects, and manipulation of authenticated user actions.

Affected Products

OpenAM versions prior to 16.1.3
OpenAM OAuth2 authorization endpoint (/oauth2/authorize)
Deployments relying on OpenAM for federated single sign-on

Discovery Timeline

2026-10-03 - CVE-2026-105114 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105114

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw classified under [CWE-79]. OpenAM's OAuth2 authorization endpoint produces an error page when request parameters are malformed or inconsistent. That error page echoes parameter values into the response HTML without applying contextual output encoding. Supplying repeated query parameters triggers the error path and places attacker-controlled content directly into the rendered DOM. Because the script executes in the OpenAM origin, it runs with the same privileges as the authenticated user's active session. An attacker can read session-bound data, invoke OAuth2 flows, or stage credential-harvesting pages that appear to originate from the legitimate identity provider.

Root Cause

The root cause is missing output encoding on user-controlled request parameters that are reflected into the OAuth2 authorization error response. OpenAM treats repeated query parameters in a way that leads error-handling code to serialize untrusted values into HTML without HTML entity encoding or context-aware escaping.

Attack Vector

Exploitation requires the victim to click a crafted link, so user interaction is necessary but no authentication is required to deliver the payload. The attacker constructs a /oauth2/authorize URL with repeated parameters whose values contain JavaScript. When the victim loads the link, the OpenAM error page renders the payload, executing script in the OpenAM origin and allowing session abuse or redirection to attacker-controlled phishing pages.

// No verified public exploit code is available.
// Refer to the GitHub Security Advisory GHSA-3m32-w9x3-vvq8 for technical details.

Detection Methods for CVE-2026-105114

Indicators of Compromise

Requests to /oauth2/authorize containing duplicate query parameter names such as repeated client_id, redirect_uri, or scope keys.
URL-encoded <script>, onerror=, or javascript: fragments appearing in OAuth2 authorization request logs.
HTTP referrers to the OpenAM origin originating from unrelated external domains or shortened URLs sent via email or chat.

Detection Strategies

Inspect OpenAM access logs for /oauth2/authorize requests containing repeated parameter keys and decode query strings before pattern matching.
Deploy web application firewall rules that flag reflected XSS payloads in OAuth2 endpoint parameters.
Correlate anomalous OAuth2 error responses with subsequent authenticated API calls from the same session to identify post-exploitation activity.

Monitoring Recommendations

Alert on spikes in OAuth2 authorization errors tied to a single client IP or user agent.
Monitor outbound redirects from the OpenAM origin to unexpected destinations, which can indicate phishing pivots.
Track browser Content Security Policy violation reports from the OpenAM origin to catch injected inline scripts.

How to Mitigate CVE-2026-105114

Immediate Actions Required

Upgrade OpenAM to version 16.1.3 or later across all production and non-production instances.
Audit recent /oauth2/authorize traffic for exploitation attempts and review associated user sessions for abuse.
Rotate OAuth2 client secrets and invalidate active sessions if exploitation evidence is found.

Patch Information

The issue is resolved in OpenAM 16.1.3. Refer to the GitHub Security Advisory GHSA-3m32-w9x3-vvq8 and the VulnCheck OpenAM XSS Advisory for upgrade guidance and remediation details.

Workarounds

Place a reverse proxy or web application firewall in front of OpenAM to reject /oauth2/authorize requests containing duplicate parameter names.
Enforce a strict Content Security Policy on the OpenAM origin to block inline script execution.
Restrict access to the OAuth2 authorization endpoint to known client networks where feasible until patching completes.

bash

# Example WAF rule concept: block OAuth2 authorize requests with repeated parameters
# (Adapt to your WAF syntax; this is illustrative, not production-ready)
SecRule REQUEST_URI "@beginsWith /oauth2/authorize" \
  "id:1050114,phase:2,deny,status:400,msg:'Repeated OAuth2 params - CVE-2026-105114',\
   chain"
  SecRule ARGS_NAMES "@rx (client_id|redirect_uri|scope|state|response_type).*\1" \
    "t:none"