TI-2026-35998 Aliases CVE-2026-48717 GHSA-4v2w-2wqp-mc85

OpenAM OAuth Authorization Bypass via PKCE Challenge

MEDIUM 40CWE-285Published 2026-09-15 · Updated 2026-09-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a code_verifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a code_challenge. Because that setting is disabled by default, an attacker who intercepts a PKCE-protected authorization code can omit code_verifier and redeem the code, while an explicitly incorrect verifier is rejected. Public clients are directly affected, and confidential-client exploitation additionally requires client authentication material or another redemption context. This issue is fixed in version 16.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00529 44th percentileScored 2026-11-07

Fix Fixed OpenAM (OpenIdentityPlatform): 16.1.1org.openidentityplatform.openam:openam-oauth2 (Maven): 16.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenIdentityPlatform	OpenAM	before 16.1.1	16.1.1	Patch available	CNA
—	org.openidentityplatform.openam:openam-oauth2 (Maven)	before 16.1.1	16.1.1	Patch available	GHSA-4v2w-2wqp-mc85

OpenAM VendorOpenIdentityPlatform Affected before 16.1.1 Fixed in 16.1.1 Patch available CNA
org.openidentityplatform.openam:openam-oauth2 (Maven) Vendor— Affected before 16.1.1 Fixed in 16.1.1 Patch available GHSA-4v2w-2wqp-mc85

Remediation

Fix · CNA OpenAM (OpenIdentityPlatform) Fixed in 16.1.1
Fix · GHSA-4v2w-2wqp-mc85 org.openidentityplatform.openam:openam-oauth2 (Maven) Fixed in 16.1.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-48717
2026-10-03 Alias added: GHSA-4v2w-2wqp-mc85

References

Other 4

TI-2025-20332 OpenDJ Denial of Service (Dos) using alias loop CVSS 4.0HIGH 8.7
TI-2026-25836 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM CVSS 4.0CRITICAL 9.3
TI-2026-86693 Session token disclosure in OpenAM notification WebSocket CVSS 4.0CRITICAL 10.0
TI-2026-86692 Authentication bypass in OpenAM SAML login accepts unsigned assertions CVSS 4.0CRITICAL 9.3
TI-2026-86691 Privilege escalation in OpenAM via self-registration attribute bypass CVSS 4.0CRITICAL 9.3
TI-2026-86685 Unbounded Java deserialization in OpenAM enables denial of service CVSS 4.0HIGH 8.7

See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences