OpenIdentityPlatform has 33 CVEs on record. Disclosure cadence is accelerating: 28 in the last 90 days against 4 in the 90 before. The busiest recent month was September 2026 with 19. The median CVSS is 7.6 (high), with 10 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-285 (6) and CWE-502 (5). Most affected products: OpenAM (28), OpenDJ (1), org.openidentityplatform.openam:openam-federation (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.6
- Publish → KEV
- —
- Last 90 days
- 28 prev 4
Weakness classes
Products
- OpenAM 28
- OpenDJ 1
- org.openidentityplatform.openam:openam-federation 1
- org.openidentityplatform.openam:openam-radius 1
- org.openidentityplatform.opendj:opendj-dsml-servlet 1
- org.openidentityplatform.opendj:opendj-server-legacy 1
Worst active — by depth score
CVE-2026-33439Critical· 9.8Open Access Management (OpenAM) is an access management solution68CVE-2026-62379Critical· 9.8Open Access Management (OpenAM) is an access management solution54GHSA-p279-2cqp-84jgCritical· 9.6OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check53GHSA-68r5-9hpg-7qw9Critical· 9.4OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway52CVE-2026-62263Critical· 9.2Open Access Management (OpenAM) is an access management solution51
OpenIdentityPlatform vulnerabilities
CVEs affecting OpenIdentityPlatform, newest first. Open any entry for full detail, references, and exploit status.
33 CVEsRSS
CVE-2026-46560High· 7.5OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing
OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing
CVE-2026-45049High· 8.3OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet
OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet
CVE-2026-33439Critical· 9.8PoCOpen Access Management (OpenAM) is an access management solution
Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP…