Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report
Check your stack
GHSA-cj8f-2fhf-826r

OpenAM Arbitrary OAuth Token Minting via Push Registration

Products / packages org.openidentityplatform.openam:openam-oauth2

Published

Share

Severity and exploitation

Not in CISA KEVSource: HIGH

KEV coverage does not rule out exploitation.

KEV checked 15/11/2026, 03:45:34 UTC
OSV · CVSS:4.0 · 7.1
Assessment vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Severity

high7.1

CVSS measures technical severity, not the likelihood of an attack.

Known exploitation

Not listed in the checked CISA KEV catalog

Absence from CISA KEV does not rule out attacks.

Public exploit

Not established by this record

Missing evidence does not mean no public exploit exists.

Remediation

Package fixes recorded

Fix versions are recorded for 1 of 1 mapped packages. Check each release branch and any separate product guidance.

What this means

Description

Source excerpt · OSV

Attack conditions

Under certain conditions, this may allow an attacker to forge OAuth2 bearer tokens and OIDC ID tokens with arbitrary subject, client, realm, and scope.

Excerpt from the original source description below.

Review supporting sources →

Affected versions

Check the exact model, release, and any platform requirements against your installation.

Packages

Compare each installed version with the publisher’s affected ranges. Where a fix is recorded, choose the appropriate release branch and test compatibility before upgrading.

What to do

Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.

Use the recorded fix for your release branch. Review the publisher’s instructions and test compatibility before upgrading.

cve.new guidance unless attributed to a publisher. This page does not inspect your installation.

Public exploit evidence

No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.

Original source description

Read the full publisher description

Summary

Description

An Authorization Bypass Through User-Controlled Key (CWE-639) exists in OpenAM's stateful OAuth2 token-read path. Under certain conditions, this may allow an attacker to forge OAuth2 bearer tokens and OIDC ID tokens with arbitrary subject, client, realm, and scope. This affects OpenAM Community Edition through version 16.0.6.

The OAuth2 token-read path reads caller-supplied token identifiers from the shared Core Token Store (CTS) without placing them in an OAuth-only namespace and without binding the row's trusted CTS type to the expected OAuth token family, so any CTS row whose BLOB claims to be an OAuth token is accepted on the read path with no integrity check.

Impact

OpenAM Community Edition deployments through version 16.0.6 with the OAuth2 Provider service enabled in a realm are potentially affected, but the vulnerable read path is only reachable once an attacker can place attacker-controlled JSON into the shared CTS under an identifier they know. For example, an anonymous Push Notification SNS callback handler, reachable by any low-privileged user in a Push Notification-enabled realm after a single legitimate Push registration can trigger the exploit.

In any deployment where such a primitive exists, an attacker can forge OAuth2 bearer tokens with attacker-chosen userName, clientID, realm, and scope. The compromise does not by itself create an OpenAM SSO session or grant admin-console access.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

References

5 sources
OpenIdentityPlatform/OpenAM · security/advisories/GHSA-cj8f-2fhf-826r
Security advisory
nvd.nist.gov/vuln/detail/CVE-2026-46498
Security advisory
OpenIdentityPlatform/OpenAM · commit e047b01
Patch
OpenIdentityPlatform/OpenAM · repository
Source reference
OpenIdentityPlatform/OpenAM · releases/tag/16.1.1
Release notes

Inside the record

Evidence available

Package identity
Version evidence
Remediation guidance · not supplied
Weakness classification · not supplied
Additional publishers · not supplied

Describes the evidence in this view, not whether the product is safe.

Original records

No official CVE record has been imported. Use the source links below for the original advisory.

cve.new JSON →

Timeline

All times UTC

  1. Advisory published

    Publication date supplied by the source.

  2. Source updated

    Latest modification date supplied by the source.

  3. Last imported by cve.new

    Latest catalog import, not the date we first saw this advisory.

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.