{"action":"Upgrade org.openidentityplatform.openam:openam-oauth2 to 16.1.2 or later.","affected":[{"fixed":"16.1.2","introduced":"13.0.0"}],"component":"org.openidentityplatform.openam:openam-oauth2","cve_ids":["CVE-2026-62280"],"ecosystem":"Maven","epss":0.00327,"exploited":false,"fixed_versions":["16.1.2"],"ghsa_id":"GHSA-vqxv-6xrh-49cp","id":"tcs_01M5N9EPHJGB2ST5E93G3RW6Y9","modified_at":"2026-07-24T21:26:41.392915Z","published_at":"2026-07-24T21:09:36Z","references":["https://osv.dev/vulnerability/GHSA-vqxv-6xrh-49cp","https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-vqxv-6xrh-49cp","https://github.com/OpenIdentityPlatform/OpenAM/commit/98cee2dfe701c2e16e5bcee34e6fd9d913925118","https://github.com/OpenIdentityPlatform/OpenAM","https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.2"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-vqxv-6xrh-49cp","url":"https://osv.dev/vulnerability/GHSA-vqxv-6xrh-49cp"}],"summary":"OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page"}