CVE-2026-44203: OpenAM OAuth 2.0 XSS Vulnerability

CVE-2026-44203 Overview

CVE-2026-44203 is a reflected cross-site scripting (XSS) vulnerability in Open Access Management (OpenAM), an open-source access management solution maintained by the Open Identity Platform. The flaw resides in the OAuth 2.0 and OpenID Connect (OIDC) authorization endpoint. User-supplied parameters passed to the FormPostResponse.ftl and checkSession.ftl templates are not sufficiently encoded before being rendered into HTML during the form_post response mode. An unauthenticated attacker can craft a malicious authorization request and induce a victim to open it, executing arbitrary JavaScript in the OpenAM origin. The issue is tracked under [CWE-79] and is fixed in OpenAM 16.1.1.

Critical Impact
Unauthenticated attackers can execute script in the OpenAM security origin, enabling session theft, credential harvesting, and OAuth token compromise against authenticated identity users.

Affected Products

Open Identity Platform OpenAM versions prior to 16.1.1
OpenAM OAuth 2.0 authorization endpoint (FormPostResponse.ftl template)
OpenAM OpenID Connect session management endpoint (checkSession.ftl template)

Discovery Timeline

2026-09-15 - CVE-2026-44203 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-44203

Vulnerability Analysis

OpenAM implements the OAuth 2.0 form_post response mode using FreeMarker templates. When a relying party (RP) invokes the authorization endpoint, OpenAM echoes several client-controlled parameters, such as redirect_uri, state, and client_id, into an auto-submitting HTML form returned to the browser. The templates FormPostResponse.ftl and checkSession.ftl interpolate these values without applying HTML-context output encoding. An attacker who controls the URL a victim visits can smuggle <script> payloads or event handlers into these parameters. The browser then renders the payload within the OpenAM origin, giving the attacker access to any cookies, tokens, or DOM state associated with that domain.

Root Cause

The defect is a missing output-encoding step [CWE-79]. FreeMarker expressions such as ${baseUrl} were emitted directly into the HTML response without the ?html built-in that neutralizes markup characters. Because the authorization endpoint accepts requests before any user authentication occurs, the sink is reachable pre-auth.

Attack Vector

Exploitation requires user interaction. An attacker crafts an authorization URL containing a malicious parameter value and delivers it through phishing, a malicious link, or a compromised RP. When the victim opens the URL, OpenAM reflects the payload into the returned form and the browser executes it in the OpenAM origin. This enables single sign-on session hijacking, forced OAuth consent, and theft of ID tokens.

text

// Patch excerpt: openam-oauth2/src/main/resources/templates/page/checkSession.ftl
-  <script src="${baseUrl}/js/sha256.js"></script>
+  <script src="${baseUrl?html}/js/sha256.js"></script>

Source: OpenAM commit 078bd47. The fix applies FreeMarker's ?html built-in to force HTML-context encoding of reflected values in both FormPostResponse.ftl and checkSession.ftl.

Detection Methods for CVE-2026-44203

Indicators of Compromise

Requests to /oauth2/authorize or OIDC endpoints containing <, >, ", or javascript: sequences inside redirect_uri, state, nonce, or client_id parameters.
HTTP referrers pointing to unfamiliar RP domains immediately preceding authentication-related activity in OpenAM audit logs.
Unexpected outbound requests from browsers to attacker-controlled hosts following an OpenAM form_post response.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect OAuth 2.0 and OIDC query parameters for HTML metacharacters and script-like tokens.
Enable OpenAM access logging on /oauth2/* and /oidc/* and alert on parameter values exceeding expected length or containing markup.
Correlate authorization-endpoint hits with subsequent session or token-issuance events to identify anomalous consent flows.

Monitoring Recommendations

Ingest OpenAM audit logs into a SIEM and build detections around reflected parameter content in form_post responses.
Monitor browser telemetry for Content Security Policy (CSP) violations originating from the OpenAM domain.
Track version banners across OpenAM deployments to identify instances still running builds earlier than 16.1.1.

How to Mitigate CVE-2026-44203

Immediate Actions Required

Upgrade all OpenAM instances to version 16.1.1 or later without delay.
Audit OAuth 2.0 client registrations and remove unused or stale redirect_uri entries that expand the reflection surface.
Rotate OpenAM administrative session cookies and OAuth client secrets after patching to invalidate any tokens obtained through prior exploitation.

Patch Information

The fix is delivered in OpenAM Release 16.1.1 via commit 078bd47. The commit adds the FreeMarker ?html encoding built-in to reflected values in FormPostResponse.ftl and checkSession.ftl. Full advisory details are published in GitHub Security Advisory GHSA-fq9h-c788-fx73.

Workarounds

Front OpenAM with a reverse proxy or WAF that strips or rejects OAuth parameters containing HTML metacharacters.
Enforce a restrictive Content Security Policy on the OpenAM origin to block inline script execution as a defense-in-depth control.
Restrict OAuth 2.0 client registrations to trusted redirect_uri values only, minimizing untrusted parameter reflection.

bash

# Example nginx reverse-proxy rule to reject markup in OAuth parameters
location ~ ^/(oauth2|oidc)/ {
    if ($args ~* "(<|%3C|%3E|javascript:|onerror=|onload=)") {
        return 400;
    }
    proxy_pass http://openam_backend;
}