TI-2026-83286 Aliases CVE-2026-46560

Authentication bypass in OpenAM via RADIUS packet spoofing

LOW 34CWE-347Published 2026-10-30 · Updated 2026-11-05

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

OpenAM before 16.1.1 and the openam-radius Maven package before 16.1.1 are affected. The RADIUS module accepts the first UDP datagram on its client port without verifying the sender, response identifier or response authenticator (CWE-347). An unauthenticated network attacker can race the real server or spray forged Access-Accept packets to get a session for any RADIUS-mapped username, with that user's privileges, when a RADIUS module is enabled on a login chain.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive path does not verify the source IP and port, match the response identifier to the outstanding request, or verify the RFC 2865 `Response Authenticator`; the RFC 2869 `Message-Authenticator` is neither sent nor required. Any non-Reject/non-Challenge packet is treated as success. On a deployment with a `RADIUS` module instance enabled on a login chain, an unauthenticated network attacker can race the real server on-path or spray forged `Access-Accept` packets off-path and obtain a session for any `RADIUS`-mapped username without knowing the shared secret. Unlike CVE-2024-3596, exploitation requires no MD5 chosen-prefix forgery because no response authenticator is checked. The resulting session carries the impersonated principal's privileges. This issue is fixed in version 16.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00186 8th percentileScored 2026-11-07

Fix Fixed OpenAM (OpenIdentityPlatform): 16.1.1org.openidentityplatform.openam:openam-radius (Maven): 16.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenIdentityPlatform	OpenAM	before 16.1.1	16.1.1	Patch available	CNA
—	org.openidentityplatform.openam:openam-radius (Maven)	before 16.1.1	16.1.1	Patch available	GHSA-386j-6m86-78f9

OpenAM VendorOpenIdentityPlatform Affected before 16.1.1 Fixed in 16.1.1 Patch available CNA
org.openidentityplatform.openam:openam-radius (Maven) Vendor— Affected before 16.1.1 Fixed in 16.1.1 Patch available GHSA-386j-6m86-78f9

Remediation

Upgrade the openam-radius Maven package to 16.1.1, which fixes the flaw. The sources list no fixed version for OpenAM.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Fix · CNA OpenAM (OpenIdentityPlatform) Fixed in 16.1.1
Fix · GHSA-386j-6m86-78f9 org.openidentityplatform.openam:openam-radius (Maven) Fixed in 16.1.1 Advisory →

Timeline

2026-10-30 Threatist record created from CVE-2026-46560
2026-11-01 Priority changed: MEDIUM → LOW
2026-11-05 CISA SSVC decision points changed

References

Other 4

TI-2025-20332 OpenDJ Denial of Service (Dos) using alias loop CVSS 4.0HIGH 8.7
TI-2026-25836 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM CVSS 4.0CRITICAL 9.3
TI-2026-44519 OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback CVSS 3.1CRITICAL 9.8
TI-2023-19079 User impersonation using SAMLv1.x SSO in Open Access Management CVSS 3.1CRITICAL 9.8
TI-2026-34275 OpenAM Authentication Bypass via MSISDN LDAP Injection CVSS 4.0CRITICAL 9.3
TI-2026-32901 OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints CVSS 4.0CRITICAL 9.3

See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences