OpenAM CVE-2026-105119

Requires the OpenAM OAuth2/OIDC provider to be configured for OpenID Connect hybrid flows - specifically response_type values of 'code token', 'code id_token', or 'code token id_token' - because PKCE enforcement is applied only when response_type is exactly 'code'. The vulnerable token exchange must involve a public client, and the attacker must be able to intercept or otherwise obtain the issued authorization code. Limiting factors: exploitation is defeated if hybrid flows are not used, the attacker cannot capture the code, or the deployment is upgraded to 16.1.3+; user interaction to complete the authorization flow is also required, and attack complexity is raised by the need to position for code interception.

This is a credible mid-tier priority rather than a drop-everything emergency. The input CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N, 7.6 High) is internally consistent with the description: no privileges are required (PR:N), but exploitation depends on an attacker meeting a specific present condition (AT:P) - intercepting an authorization code - plus user interaction (UI:P) and higher attack complexity (AC:H). The high confidentiality and integrity impact (VC:H/VI:H) reflects full token/account takeover for the affected public client. Working against priority: there is no CISA KEV listing, no vendor/VulnCheck claim of active exploitation, and no EPSS score supplied, so there is no evidence of in-the-wild use. No public exploit is identified in the provided data. The real constraint is that the attacker must already be positioned to intercept the code (e.g., via a redirect/referer leak, logging, or network interception) AND the deployment must actually use OIDC hybrid flows with public clients - this is the signal that most limits mass exploitation. Net: a genuine authorization/PKCE-defeat flaw worth patching promptly for anyone running OIDC hybrid flows, but the interception precondition and absence of exploitation signals keep it below critical.

An OpenAM deployment exposes an OIDC public client using a hybrid flow (e.g., response_type=code id_token). An attacker who obtains the authorization code - for instance by capturing it from a leaked redirect URI, referer header, or intercepted channel - replays it against the token endpoint supplying any arbitrary non-empty code_verifier, which PKCE should have rejected, and receives valid tokens for the victim's session. No public proof-of-concept is identified at time of analysis.