---
id: CVE-2026-123539
title: OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display Name
summary: >-
  OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that
  allows privileged attackers to inject script by placing markup in a user's
  display name. When the victim reaches the OAuth 2.0 / OpenID Connect consent
  page, …
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: OpenIdentityPlatform
product: OpenAM
affected:
  - OpenAM < 16.1.4
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:37:45.918Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123539'
references:
  - url: >-
      https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-v6hq-3cfh-5gr6
    label: GitHub Security Advisory (GHSA-v6hq-3cfh-5gr6)
  - url: >-
      https://www.vulncheck.com/advisories/openam-before-16.1.4-stored-xss-via-oauth-2.0-consent-page-display-name
    label: >-
      VulnCheck Advisory: OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent
      Page Display Name
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.680Z'
---

## Overview

OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that allows privileged attackers to inject script by placing markup in a user's display name. When the victim reaches the OAuth 2.0 / OpenID Connect consent page, the unencoded name executes script that can steal the OpenAM session cookie to impersonate the user.

## Affected

- `OpenAM < 16.1.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.