CVE-2026-62280: OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
The OAuth2/OIDC consent page rendered for display=wap authorize requests reflected several request-derived values into the HTML response without escaping. An attacker who induces a user with an active OpenAM session to follow a crafted authorize link can execute arbitrary JavaScript in the OpenAM origin.
This is the same vulnerability class as CVE-2026-44203; that fix did not cover this code path.
References
- github.com/OpenIdentityPlatform/OpenAM/commit/98cee2dfe701c2e16e5bcee34e6fd9d913925118
- github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2
- github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-vqxv-6xrh-49cp
- github.com/advisories/GHSA-vqxv-6xrh-49cp
- nvd.nist.gov/vuln/detail/CVE-2026-62280
Code Behaviors & Features
Detect and mitigate CVE-2026-62280 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →