TI-2025-39550 Aliases CVE-2025-64099 GHSA-39hr-239p-fhqc

OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_info

MEDIUM 43CWE-74Published 2025-11-12 · Updated 2025-11-12

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the "claims_parameter_supported" parameter is activated, it is possible, thanks to the "oidc-claims-extension.groovy" script, to inject the value of one's choice into a claim contained in the id_token or in the user_info. In the request of an authorize function, a claims parameter containing a JSON file can be injected. This JSON file allows attackers to customize the claims returned by the "id_token" and "user_info" files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, an attacker can choose the email address they want, and therefore assume any identity they choose. Version 16.0.0 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00353 29th percentileScored 2026-11-07

Fix Fixed OpenAM (OpenIdentityPlatform): 16.0.0org.openidentityplatform.openam:openam-oauth2 (Maven): 16.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenIdentityPlatform	OpenAM	before 16.0.0	16.0.0	Patch available	CNA
—	org.openidentityplatform.openam:openam-oauth2 (Maven)	before 16.0.3	16.0.3	Patch available	GHSA-39hr-239p-fhqc

OpenAM VendorOpenIdentityPlatform Affected before 16.0.0 Fixed in 16.0.0 Patch available CNA
org.openidentityplatform.openam:openam-oauth2 (Maven) Vendor— Affected before 16.0.3 Fixed in 16.0.3 Patch available GHSA-39hr-239p-fhqc

Remediation

Fix · CNA OpenAM (OpenIdentityPlatform) Fixed in 16.0.0
Fix · GHSA-39hr-239p-fhqc org.openidentityplatform.openam:openam-oauth2 (Maven) Fixed in 16.0.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-64099
2026-10-03 Alias added: GHSA-39hr-239p-fhqc

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-64099

Other 4

TI-2025-20332 OpenDJ Denial of Service (Dos) using alias loop CVSS 4.0HIGH 8.7
TI-2026-25836 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM CVSS 4.0CRITICAL 9.3
TI-2026-86693 Session token disclosure in OpenAM notification WebSocket CVSS 4.0CRITICAL 10.0
TI-2026-86692 Authentication bypass in OpenAM SAML login accepts unsigned assertions CVSS 4.0CRITICAL 9.3
TI-2026-86691 Privilege escalation in OpenAM via self-registration attribute bypass CVSS 4.0CRITICAL 9.3
TI-2026-86685 Unbounded Java deserialization in OpenAM enables denial of service CVSS 4.0HIGH 8.7

See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences