Read the docs
TI-2026-67494 Aliases CVE-2026-105119GHSA-mf8f-w84m-x4gc

OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows

Priority LOW 35CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through OpenID Connect hybrid flows (code token, code id_token, code token id_token) carry no bound challenge. An attacker who intercepts such a code can redeem it for a public client's tokens with any non-empty code_verifier.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Fix Fixed OpenAM (OpenIdentityPlatform): 16.1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenIdentityPlatformOpenAMbefore 16.1.316.1.3Patch availableCNA

Remediation

  • Fix · CNA OpenAM (OpenIdentityPlatform) Fixed in 16.1.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    OpenIdentityPlatform OpenAM 16.1.3

    9 records Highest priority Priority MEDIUM 1 MEDIUM, 8 LOW

    Other records, highest priority first

    • TI-2026-67490 OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC InterfacePriority MEDIUM 44
    • TI-2026-67496 OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm ScopingPriority LOW 30
    • TI-2026-67495 OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST EndpointPriority LOW 30
    Show all 9 records →

Timeline

  1. 2026-10-03 Threatist record created from CVE-2026-105119
  2. 2026-10-03 Alias added: GHSA-mf8f-w84m-x4gc
  3. 2026-10-04 Priority changed: MEDIUM → LOW
  4. 2026-10-06 CISA SSVC decision points changed

References

Advisory 1

  • TI-2025-20332 OpenDJ Denial of Service (Dos) using alias loop CVSS 4.0HIGH 8.7
  • TI-2026-25836 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM CVSS 4.0CRITICAL 9.3
  • TI-2026-44519 OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback CVSS 3.1CRITICAL 9.8
  • TI-2023-19079 User impersonation using SAMLv1.x SSO in Open Access Management CVSS 3.1CRITICAL 9.8
  • TI-2026-34275 OpenAM Authentication Bypass via MSISDN LDAP Injection CVSS 4.0CRITICAL 9.3
  • TI-2026-32901 OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints CVSS 4.0CRITICAL 9.3
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences