All vulnerabilities
CVE-2026-46498GHSA-cj8f-2fhf-826r

OpenAM Arbitrary OAuth Token Minting via Push Registration

OpenIdentityPlatform org.openidentityplatform.openam:openam-oauth2mavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.41%Chance of exploitation activity in the next 30 days, higher than 35% of CVEs. Scored 28 Oct 2026FIRST EPSS
Fixed in16.1.1Fixed versionGitHub
Published15 Sep 2026Updated 28 Oct 2026CVE List

What fixes it

  • 16.1.1org.openidentityplatform.openam:openam-oauth2, mavenGitHub<dependency><groupId>org.openidentityplatform.openam</groupId><artifactId>openam-oauth2</artifactId><version>16.1.1</version></dependency>
  • 16.1.1org.openidentityplatform.openam:openam-oauth2, MavenOSV<dependency><groupId>org.openidentityplatform.openam</groupId><artifactId>openam-oauth2</artifactId><version>16.1.1</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

Description

An Authorization Bypass Through User-Controlled Key (CWE-639) exists in OpenAM's stateful OAuth2 token-read path. Under certain conditions, this may allow an attacker to forge OAuth2 bearer tokens and OIDC ID tokens with arbitrary subject, client, realm, and scope. This affects OpenAM Community Edition through version 16.0.6.

The OAuth2 token-read path reads caller-supplied token identifiers from the shared Core Token Store (CTS) without placing them in an OAuth-only namespace and without binding the row's trusted CTS type to the expected OAuth token family, so any CTS row whose BLOB claims to be an OAuth token is accepted on the read path with no integrity check.

Impact

OpenAM Community Edition deployments through version 16.0.6 with the OAuth2 Provider service enabled in a realm are potentially affected, but the vulnerable read path is only reachable once an attacker can place attacker-controlled JSON into the shared CTS under an identifier they know. For example, an anonymous Push Notification SNS callback handler, reachable by any low-privileged user in a Push Notification-enabled realm after a single legitimate Push registration can trigger the exploit.

In any deployment where such a primitive exists, an attacker can forge OAuth2 bearer tokens with attacker-chosen userName, clientID, realm, and scope. The compromise does not by itself create an OpenAM SSO session or grant admin-console access.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

Text from GitHub Advisory Database

Affected versions 43

  • org.openidentityplatform.openam:openam-oauth2, maven< 16.1.1GitHub
  • OpenAMaffected: < 16.1.1CVE List
  • org.openidentityplatform.openam:openam-oauth2, Mavenfrom first release, fixed in 16.1.1OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.5.2OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.5.3OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.5.4OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.6.1OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.6.2OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.6.3OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.6.4OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.6.5OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.6.6OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.7.0OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.7.1OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.7.2OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.7.3OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.7.4OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.8.1OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.8.2OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.8.3OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven14.8.4OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.0.0OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.0.1OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.0.2OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.0.3OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.0.4OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.1.0OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.1.1OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.1.2OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.1.3OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.1.4OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.1.5OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.1.6OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.2.0OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.2.1OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven15.2.2OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven16.0.1OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven16.0.2OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven16.0.3OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven16.0.4OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven16.0.5OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven16.0.6OSV
  • org.openidentityplatform.openam:openam-oauth2, Maven16.1.0OSV

References 5