Skip to content

Actions: OpenIdentityPlatform/OpenAM

Actions

CodeQL

Actions

Loading...
Loading

Show workflow options

Create status badge

Loading
codeql.yml
63 workflow runs
63 workflow runs

Filter by Event

⌥ + click/return to exclude

Filter by Status

⌥ + click/return to exclude

Filter by Branch

⌥ + click/return to exclude

Filter by Actor

⌥ + click/return to exclude
Harden AuthXMLRequest.setPrincipal against arbitrary class instantiation (same pattern as GHSA-wg5r-wc3x-39vc) CodeQL #63: Pull request #1088 opened by BarakSrour
Action required BarakSrour:harden/authxmlrequest-setprincipal-reflection
BarakSrour:harden/authxmlrequest-setprincipal-reflection
Action required
[#1082] Fix docs contradicting each other on XUI + HttpOnly session c… CodeQL #62: Commit b4c030a pushed by maximthomas
1h 22m 11s master
master
1h 22m 11s
GHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Au… CodeQL #61: Commit ba4af5d pushed by vharseko
19m 9s master
master
19m 9s
GHSA-qwww-vcr4-c8h2 React Router: RSC Mode CSRF Bypass Allows Action … CodeQL #60: Commit a6f70a8 pushed by vharseko
39s master
master
39s
GHSA-qwww-vcr4-c8h2 React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response CodeQL #59: Pull request #1087 opened by dependabot Bot
49m 42s dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/react-router-8.3.0
dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/react-router-8.3.0
49m 42s
GHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure CodeQL #58: Pull request #1086 opened by dependabot Bot
1h 13m 40s dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/postcss-8.5.23
dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/postcss-8.5.23
1h 13m 40s
CVE-2026-59949 at.yawk.lz4:lz4-java: Native XXHash implementations ca… CodeQL #57: Commit 20fbed2 pushed by vharseko
50m 43s master
master
50m 43s
CVE-2026-59949 at.yawk.lz4:lz4-java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges CodeQL #56: Pull request #1085 opened by dependabot Bot
14m 31s dependabot/maven/openam-cassandra/at.yawk.lz4-lz4-java-1.11.1
dependabot/maven/openam-cassandra/at.yawk.lz4-lz4-java-1.11.1
14m 31s
[#1082] Fix docs contradicting each other on XUI + HttpOnly session cookies CodeQL #55: Pull request #1084 opened by maximthomas
1h 0m 36s maximthomas:issues/1082-docs-contradict
maximthomas:issues/1082-docs-contradict
1h 0m 36s
[#1080] OAuth2 consent: accept the resource owner's session id as the csrf value CodeQL #54: Pull request #1083 opened by maximthomas
1h 42m 8s maximthomas:issues/1080-csrf-session
maximthomas:issues/1080-csrf-session
1h 42m 8s
[#1080] OAuth2 consent: serve the consent details as JSON CodeQL #53: Pull request #1081 opened by maximthomas
14m 21s maximthomas:issues/1080-oauth2-json-consent
maximthomas:issues/1080-oauth2-json-consent
14m 21s
CodeQL CodeQL #52: Scheduled
18m 32s master
master
18m 32s
CVE-2026-53666 CVE-2026-53669 React Router: Arbitrary Constructor Inj… CodeQL #51: Commit 32f2b95 pushed by vharseko
19m 10s master
master
19m 10s
CVE-2026-59887 linkify-it: Quadratic-complexity DoS via the mailto:… CodeQL #50: Commit 6ec59a2 pushed by vharseko
21s master
master
21s
CVE-2026-13676 CVE-2026-16221 fast-uri vulnerable to host confusion v… CodeQL #49: Commit 628c73b pushed by vharseko
28s master
master
28s
CVE-2026-53666 CVE-2026-53669 React Router: Arbitrary Constructor Injection via deserializeErrors() Open redirect via backslash in <Link> and useNavigate CodeQL #48: Pull request #1079 opened by dependabot Bot
1h 9m 46s dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/react-router-7.18.0
dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/react-router-7.18.0
1h 9m 46s
CVE-2026-59887 linkify-it: Quadratic-complexity DoS via the mailto: validator scan-loop on attacker text CodeQL #47: Pull request #1078 opened by dependabot Bot
27m 1s dependabot/npm_and_yarn/openam-ui/openam-ui-ria/linkify-it-5.0.2
dependabot/npm_and_yarn/openam-ui/openam-ui-ria/linkify-it-5.0.2
27m 1s
CVE-2026-13676 CVE-2026-16221 fast-uri vulnerable to host confusion via literal backslash authority delimiter CodeQL #46: Pull request #1077 opened by dependabot Bot
42m 13s dependabot/npm_and_yarn/openam-ui/openam-ui-ria/fast-uri-3.1.4
dependabot/npm_and_yarn/openam-ui/openam-ui-ria/fast-uri-3.1.4
42m 13s
CVE-2026-59879 Immutable.js List 32-bit trie overflow → unrecoverab… CodeQL #45: Commit e0b6965 pushed by vharseko
15m 57s master
master
15m 57s
CVE-2026-59879 Immutable.js List 32-bit trie overflow → unrecoverable DoS CodeQL #44: Pull request #1076 opened by dependabot Bot
16m 35s dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/immutable-5.1.9
dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/immutable-5.1.9
16m 35s
JAXB3 Migration CodeQL #43: Pull request #1023 synchronize by vharseko
11m 59s maximthomas:features/jaxb3-update-2026-05-19
maximthomas:features/jaxb3-update-2026-05-19
11m 59s
CVE-2026-59869 js-yaml: YAML merge-key chains can force quadratic CPU… CodeQL #42: Commit 0dc64c0 pushed by vharseko
23m 35s master
master
23m 35s
CVE-2026-59869 js-yaml: YAML merge-key chains can force quadratic CPU consumption CodeQL #41: Pull request #1074 opened by dependabot Bot
38m 54s dependabot/npm_and_yarn/openam-ui/openam-ui-ria/js-yaml-4.3.0
dependabot/npm_and_yarn/openam-ui/openam-ui-ria/js-yaml-4.3.0
38m 54s
CVE-2026-13149 CVE-2026-33750 CVE-2026-33750 CVE-2026-45149 brace-exp… CodeQL #40: Commit 73256a0 pushed by vharseko
24m 38s master
master
24m 38s
CVE-2026-13149 CVE-2026-33750 CVE-2026-33750 CVE-2026-45149 brace-expansion: DoS protection CodeQL #39: Pull request #1073 synchronize by maximthomas
13m 28s dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/multi-ccfdbfde72
dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/multi-ccfdbfde72
13m 28s