← All credits

maximthomas

26 vulnerability records and advisories credit this contributor.

CVE-2026-123545

OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow

CVE-2026-123544

OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel

CVE-2026-123543

OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java Deserialisation

CVE-2026-123541

OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching

CVE-2026-123540

OpenAM before 16.1.4 Incomplete Attribute Encoding in SAML 1.x Form POST

CVE-2026-123539

OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display Name

CVE-2026-123537

OpenAM before 16.1.4 SSRF via UMA Scope Description URLs

CVE-2026-123536

OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs

CVE-2026-105119

OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows

CVE-2026-105116

OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page