CVE-2026-123539
MEDIUM
NVD
CVSS Score
4.8
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that allows privileged attackers to inject script by placing markup in a user's display name. When the victim reaches the OAuth 2.0 / OpenID Connect consent page, the unencoded name executes script that can steal the OpenAM session cookie to impersonate the user.