All vulnerabilities
CVE-2026-46560GHSA-386j-6m86-78f9

OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing

org.openidentityplatform.openam:openam-radiusmavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in16.1.1Fixed versionGitHub
Published25 Jun 2026Updated 28 Oct 2026GitHub

What fixes it

  • 16.1.1org.openidentityplatform.openam:openam-radius, mavenGitHub<dependency><groupId>org.openidentityplatform.openam</groupId><artifactId>openam-radius</artifactId><version>16.1.1</version></dependency>
  • 16.1.1org.openidentityplatform.openam:openam-radius, MavenOSV<dependency><groupId>org.openidentityplatform.openam</groupId><artifactId>openam-radius</artifactId><version>16.1.1</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

Description

An Improper Verification of Cryptographic Signature (CWE-347) issue in OpenAM's RADIUS authentication module allows an unauthenticated network attacker to spoof an Access-Accept response and obtain an OpenAM session for any RADIUS username, without knowing the configured shared secret. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.

The RADIUS client opens an unconnected datagram socket and treats the first UDP datagram delivered to its source port as authoritative. The receive path does not check the source IP/port, does not match the response identifier to the outstanding request, and does not verify the Response Authenticator (RFC 2865 §3); the RFC 2869 Message-Authenticator is neither sent nor required. Any non-Reject/non-Challenge packet is treated as success, so a forged Access-Accept is accepted as a valid login.

Impact

OpenAM Community Edition deployments through version 16.0.6 where an administrator has enabled a RADIUS module instance on a login chain are potentially affected. An attacker either races the real server on-path, or off-path sprays forged Access-Accept packets at the OpenAM client port. Because the client performs no verification of the response authenticator, no MD5 chosen-prefix forgery is required, which is is materially stronger than the BlastRADIUS family (CVE-2024-3596), in which an attacker must still forge a valid authenticator.

Successful exploitation yields pre-authentication impersonation of any RADIUS-mapped user in any affected realm. The resulting session is indistinguishable from a legitimate RADIUS login and carries the named principal's privileges.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

Text from GitHub Advisory Database

Affected versions 42

  • org.openidentityplatform.openam:openam-radius, maven< 16.1.1GitHub
  • org.openidentityplatform.openam:openam-radius, Mavenfrom first release, fixed in 16.1.1OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.5.2OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.5.3OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.5.4OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.6.1OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.6.2OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.6.3OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.6.4OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.6.5OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.6.6OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.7.0OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.7.1OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.7.2OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.7.3OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.7.4OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.8.1OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.8.2OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.8.3OSV
  • org.openidentityplatform.openam:openam-radius, Maven14.8.4OSV
  • org.openidentityplatform.openam:openam-radius, Maven15.0.0OSV
  • org.openidentityplatform.openam:openam-radius, Maven15.0.1OSV
  • org.openidentityplatform.openam:openam-radius, Maven15.0.2OSV
  • org.openidentityplatform.openam:openam-radius, Maven15.0.3OSV
  • org.openidentityplatform.openam:openam-radius, Maven15.0.4OSV
  • org.openidentityplatform.openam:openam-radius, Maven15.1.0OSV
  • org.openidentityplatform.openam:openam-radius, Maven15.1.1OSV
  • org.openidentityplatform.openam:openam-radius, Maven15.1.2OSV
  • org.openidentityplatform.openam:openam-radius, Maven15.1.3OSV
  • org.openidentityplatform.openam:openam-radius, Maven15.1.4OSV
  • org.openidentityplatform.openam:openam-radius, Maven15.1.5OSV
  • org.openidentityplatform.openam:openam-radius, Maven15.1.6OSV
  • org.openidentityplatform.openam:openam-radius, Maven15.2.0OSV
  • org.openidentityplatform.openam:openam-radius, Maven15.2.1OSV
  • org.openidentityplatform.openam:openam-radius, Maven15.2.2OSV
  • org.openidentityplatform.openam:openam-radius, Maven16.0.1OSV
  • org.openidentityplatform.openam:openam-radius, Maven16.0.2OSV
  • org.openidentityplatform.openam:openam-radius, Maven16.0.3OSV
  • org.openidentityplatform.openam:openam-radius, Maven16.0.4OSV
  • org.openidentityplatform.openam:openam-radius, Maven16.0.5OSV
  • org.openidentityplatform.openam:openam-radius, Maven16.0.6OSV
  • org.openidentityplatform.openam:openam-radius, Maven16.1.0OSV

References 4