What is GHSA-fhrq-3gmx-p879?

GHSA-fhrq-3gmx-p879 is a security advisory published by GitHub Security Advisories with Low severity. OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`

Which CVE IDs does GHSA-fhrq-3gmx-p879 cover?

GHSA-fhrq-3gmx-p879 covers the following CVE IDs: CVE-2026-44793. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-fhrq-3gmx-p879?

GHSA-fhrq-3gmx-p879 affects 1 product, including: maven/org.openidentityplatform.openam:openam-federation-library:\u003c 16.1.1.

GHSA-fhrq-3gmx-p879Low

OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`

Vendor

GitHub Security Advisories

Published

June 22, 2026

Last Modified

October 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-44793 →

📋 Description

Summary

Certain federation endpoints do not consistently apply output encoding when rendering user-supplied parameters into HTML responses. Under a non-default configuration used in some clustered deployments, this inconsistency can result in reflected XSS in the OpenAM origin without authentication.

🎯 Affected products1

maven/org.openidentityplatform.openam:openam-federation-library:< 16.1.1

🔗 References (5)

https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-fhrq-3gmx-p879
https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1
https://nvd.nist.gov/vuln/detail/CVE-2026-44793
https://github.com/OpenIdentityPlatform/OpenAM/commit/2f5e9bf4c28a4c9e97ded6ebd75e4e1ec241c894
https://github.com/advisories/GHSA-fhrq-3gmx-p879