CVE-2026-62280: OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
The OAuth2/OIDC consent page rendered for display=wap authorize requests reflected several request-derived values into the HTML response without escaping. An attacker who induces a user with an active OpenAM session to follow a crafted authorize link can execute arbitrary JavaScript in the OpenAM origin.
This is the same vulnerability class as CVE-2026-44203; that fix did not cover this code path.
References
- github.com/OpenIdentityPlatform/OpenAM/commit/98cee2dfe701c2e16e5bcee34e6fd9d913925118
- github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2
- github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-vqxv-6xrh-49cp
- github.com/advisories/GHSA-vqxv-6xrh-49cp
- nvd.nist.gov/vuln/detail/CVE-2026-62280
Code Behaviors & Features
Detect and mitigate CVE-2026-62280 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →