← All credits

maximthomas

8 vulnerability records and advisories credit this contributor.

CVE-2026-105122

OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri

CVE-2026-105121

OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping

CVE-2026-105120

OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint

CVE-2026-105119

OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows

CVE-2026-105118

OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession

CVE-2026-105117

OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions

CVE-2026-105116

OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page

CVE-2026-105115

OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface