GHSA-7726-43hg-m23v is a high-severity (CVSS 8.8) Code Injection vulnerability in org.openidentityplatform.openam:openam-oauth2. A fix is available for org.openidentityplatform.openam:openam-oauth2 — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-7726-43hg-m23v.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
org.openidentityplatform.openam:openam-oauth2Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to override the default PingOne Advanced Identity Cloud login page,they did not restrict the CustomLoginUrlTemplate, allowing it to be set freely. Commit fcb8432aa77d5b2e147624fe954cb150c568e0b8 introduces TemplateClassResolver.SAFER_RESOLVER to disable the resolution of commonly exploited classes in FreeMarker template injection. As of time of publication, this fix is expected to be part of version 15.0.4.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.openidentityplatform.openam:openam-oauth2 | all versions | 15.0.4org.openidentityplatform.openam:openam-oauth2:15.0.4 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.openidentityplatform.openam:openam-oauth2, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.openidentityplatform.openam:openam-oauth2 to 15.0.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-7726-43hg-m23v is resolved across your whole dependency graph.
Workarounds
Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.
How to detect GHSA-7726-43hg-m23v
A community-maintained Nuclei template exists for this CVE. You can scan for it directly:
nuclei -id ghsa-7726-43hg-m23v -u https://target- Template
- OpenAM<=15.0.3 FreeMarker - Template Injection
- Severity
- high
- Impact
- Authenticated attackers can exploit template injection to execute arbitrary code on the OpenAM server.
- Remediation
- Update OpenAM to a version later than 15.0.3 that patches the template injection vulnerability.
Template by ProjectDiscovery nuclei-templates (iamnoooob, rootxharsh, pdresearch), MIT licensed. View the full template. Scan only systems you are authorised to test.
Frequently Asked Questions
Is GHSA-7726-43hg-m23v in your dependencies?
Find it across Maven, including transitive dependencies.