OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`
Date: 2026-06
Affected: maven/org.openidentityplatform.openam:openam-federation-library
Attack vector: xss
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-44203
CVE-2026-44793
CWE: CWE-79
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)

## Summary Certain federation endpoints do not consistently apply output encoding when rendering user-supplied parameters into HTML responses. Under a non-default configuration used in some clustered deployments, this inconsistency can result in reflected XSS in the OpenAM origin without authentication.


Mitigations:

Architectural layers (MAESTRO):