9.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44203

CVE-2026-44203: OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

Summary

The OAuth 2.0 / OpenID Connect authorization endpoint does not sufficiently sanitize certain user-supplied parameters before incorporating them into the HTML response generated for the form_post response mode. This may allow an attacker to inject content into the rendered page in the context of the OpenAM origin.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44203

CVE-2026-44203:

9.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.openidentityplatform.openam:openam-oauth2	maven	>= 13.0.0, < 16.1.1	16.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of commit 078bd4754905f5130eaa7bbe45f958eaeb7fd0d7 revealed fixes for a Reflected Cross-Site Scripting (XSS) vulnerability in two separate FreeMarker templates. The root cause is the lack of output encoding for user-supplied data when generating HTML responses.

The primary vulnerability, described in the advisory, is in the OAuth 2.0 form_post response mode. The FormPostResponse.ftl template was modified to add HTML escaping (?html) to the redirectUri and the formValues map, which contains the potentially malicious state parameter. The Java method responsible for preparing this data and rendering the template is org.forgerock.openam.oauth2.handlers.FormPostResponseHandler.buildResponse. This function would appear in a runtime profile when the vulnerability is triggered.
A similar XSS flaw was fixed in the checkSession.ftl template, which is used for OpenID Connect session management. The baseUrl variable was not escaped before being included in a <script> tag. The org.forgerock.openam.oauth2.CheckSessionIFrame.service method is the server-side function that prepares the data for this template.

Both identified functions are the points where unsanitized data is passed to the vulnerable templates, making them the key runtime indicators for this vulnerability.

Vulnerable functions

org.forgerock.openam.oauth2.handlers.FormPostResponseHandler.buildResponse

openam-oauth2/src/main/resources/templates/FormPostResponse.ftl

The vulnerability lies in the `FormPostResponse.ftl` template, which is used by the `FormPostResponseHandler.buildResponse` method. This method handles the OAuth 2.0 `form_post` response mode. It collects parameters, including the user-controllable `state` parameter, into the `formValues` map. Before the patch, the template rendered these values directly into the HTML without escaping. An attacker could provide a malicious `state` parameter containing HTML and script, which would be executed in the user's browser. The patch adds `?html` to escape the output.

org.forgerock.openam.oauth2.CheckSessionIFrame.service

openam-oauth2/src/main/resources/templates/page/checkSession.ftl

The `checkSession.ftl` template, rendered by the `CheckSessionIFrame.service` method for OIDC session management, was vulnerable to XSS. The `baseUrl` variable was rendered into a `<script>` tag's `src` attribute without HTML escaping. This could allow an attacker to manipulate the `baseUrl` to point to a malicious script or inject code directly. The patch mitigates this by adding `?html` escaping to the `baseUrl` variable.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.