CVE-2026-44793: Open Access Management (OpenAM) XSS Vulnerability

CVE-2026-44793 Overview

CVE-2026-44793 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in Open Access Management (OpenAM), an open-source access management and federation solution. In non-default clustered deployments, certain federation endpoints inconsistently encode user-supplied parameters rendered into HTML along the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can craft a malicious link that, when followed by a victim, executes attacker-controlled script in the OpenAM origin. Because OpenAM handles authentication and single sign-on, script execution in that origin can expose session material and federation flows. The issue is fixed in OpenAM 16.1.1.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the OpenAM origin by tricking users into following crafted federation requests, enabling session theft and SSO abuse.

Affected Products

Open Identity Platform OpenAM prior to version 16.1.1
OpenAM deployments running in non-default clustered configurations
SAML2 federation endpoints using the cluster cookie-hash redirect path

Discovery Timeline

2026-09-15 - CVE-2026-44793 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-44793

Vulnerability Analysis

The flaw is a reflected XSS defect in OpenAM's SAML2 federation flow. When OpenAM is deployed in a clustered configuration, requests to certain federation endpoints traverse a cookie-hash redirect path used to preserve session affinity across cluster nodes. Along this path, user-supplied parameters are rendered into an HTML response with inconsistent output encoding. An attacker who lures an authenticated or unauthenticated user to a crafted URL can inject script that runs in the OpenAM origin. Because OpenAM issues SSO tokens and brokers SAML2 assertions, script execution in that origin exposes authentication cookies, initiates malicious federation requests, and manipulates single sign-on flows. User interaction is required, which reduces mass exploitation potential but keeps phishing and social-engineering vectors viable.

Root Cause

The root cause is inconsistent HTML output encoding of untrusted parameters that transit the SAML2 cluster cookie-hash redirect handler. Encoding is applied along some code paths but omitted on others, so attacker-controlled input reaches the HTML response without contextual escaping. This is a classic improper neutralization of input during web page generation [CWE-79].

Attack Vector

Exploitation is network-based and does not require authentication. The attacker constructs a URL targeting the vulnerable federation endpoint with a payload in a reflected parameter. The victim must click the link or be redirected to it, at which point the OpenAM response renders the payload and executes it in the browser under the OpenAM origin.

java

// Patch context from the OpenAM 16.1.1 fix
// File: openam-oauth2/src/main/java/org/forgerock/oauth2/core/AuthorizeRequestValidatorImpl.java
 *
 * Copyright 2014-2016 ForgeRock AS.
 * Portions Copyrighted 2018 Open Source Solution Technology Corporation
- * Portions copyright 2025 3A Systems LLC.
+ * Portions copyright 2025-2026 3A Systems LLC.
 */

package org.forgerock.oauth2.core;

Source: OpenAM commit 2f5e9bf. The patch tightens parameter handling in federation request validation; refer to the full commit for the encoding changes applied to the SAML2 cluster cookie-hash redirect path.

Detection Methods for CVE-2026-44793

Indicators of Compromise

Requests to OpenAM SAML2 federation endpoints containing HTML or JavaScript tokens such as <script, onerror=, javascript:, or encoded variants in query parameters.
Unexpected 200-response HTML bodies from cluster cookie-hash redirect handlers that reflect unescaped user-supplied values.
Outbound requests from user browsers to unfamiliar domains immediately following OpenAM federation redirects, indicating potential token exfiltration.

Detection Strategies

Inspect web server, reverse proxy, and WAF logs for federation URLs containing angle brackets, event-handler attributes, or URL-encoded XSS payloads directed at OpenAM.
Correlate SSO token issuance events with anomalous referer headers or short-lived sessions initiated from external inbound links.
Monitor OpenAM audit logs for federation requests carrying parameters that do not match expected schemas for SAML2 flows.

Monitoring Recommendations

Enable verbose logging on OpenAM federation endpoints in clustered deployments and forward events to a centralized analytics platform.
Deploy a Content Security Policy (CSP) in report-only mode to surface script execution attempts in the OpenAM origin.
Alert on repeated failed or malformed requests to SAML2 cluster cookie-hash redirect URLs from single source addresses.

How to Mitigate CVE-2026-44793

Immediate Actions Required

Upgrade all OpenAM instances to version 16.1.1, which contains the encoding fix for the SAML2 cluster cookie-hash redirect path.
Inventory OpenAM deployments and identify any running in non-default clustered configurations, as these are the primary exposure surface.
Rotate SSO signing keys and invalidate active sessions if exploitation is suspected based on log review.

Patch Information

The fix is delivered in OpenAM Release 16.1.1. Technical details are documented in the GitHub Security Advisory GHSA-fhrq-3gmx-p879 and the corresponding source commit.

Workarounds

Place a web application firewall in front of OpenAM to block requests containing HTML metacharacters or script payloads targeting federation endpoints.
Enforce a strict Content Security Policy on the OpenAM origin to restrict inline script execution and third-party script sources.
Set HttpOnly and Secure flags on OpenAM session cookies and use SameSite=Lax or stricter to reduce cookie theft impact.

bash

# Example WAF rule (ModSecurity) blocking reflected XSS payloads on OpenAM federation paths
SecRule REQUEST_URI "@rx /openam/(saml2|federation)/" \
  "id:1044793,phase:2,deny,status:403,log,msg:'CVE-2026-44793 candidate XSS payload',\
  chain"
  SecRule ARGS "@rx (?i)(<script|onerror=|javascript:|%3Cscript)" "t:none,t:urlDecodeUni"