What is the CVSS score of CVE-2026-46560?

CVE-2026-46560 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Which versions of OpenAM are affected by CVE-2026-46560?

OpenAM Community Edition versions through 16.0.6 allow unauthenticated attackers to forge valid user sessions for any RADIUS-authenticated user without credentials.. A patch is available.

How to fix or mitigate CVE-2026-46560?

Within 24 hours: Inventory all systems running OpenAM Community Edition 16.0.6 or earlier with RADIUS authentication enabled. Within 7 days: Prepare and validate upgrade to OpenAM Community Edition version 16.1.1 in a staging environment. Within 30 days: Complete production deployment of version 16.1.1 and confirm RADIUS authentication function correctly.

OpenAM CVE-2026-46560

HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-06-25 https://github.com/OpenIdentityPlatform/OpenAM

GHSA-386j-6m86-78f9

Information Disclosure Jwt Attack

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.4 HIGH

Off-path attacker sprays forged packets with no source/authenticator check, so AV:N/PR:N; timing race against the real server keeps AC:H; full session impersonation gives C:H/I:H but no direct availability loss (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 25, 2026 - 17:50 vuln.today

Analysis Generated

Jun 25, 2026 - 17:50 vuln.today

DescriptionGitHub Advisory

Summary

Description

An Improper Verification of Cryptographic Signature (CWE-347) issue in OpenAM's RADIUS authentication module allows an unauthenticated network attacker to spoof an Access-Accept response and obtain an OpenAM session for any RADIUS username, without knowing the configured shared secret. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.

The RADIUS client opens an unconnected datagram socket and treats the first UDP datagram delivered to its source port as authoritative. The receive path does not check the source IP/port, does not match the response identifier to the outstanding request, and does not verify the Response Authenticator (RFC 2865 §3); the RFC 2869 Message-Authenticator is neither sent nor required. Any non-Reject/non-Challenge packet is treated as success, so a forged Access-Accept is accepted as a valid login.

Impact

OpenAM Community Edition deployments through version 16.0.6 where an administrator has enabled a RADIUS module instance on a login chain are potentially affected. An attacker either races the real server on-path, or off-path sprays forged Access-Accept packets at the OpenAM client port. Because the client performs no verification of the response authenticator, no MD5 chosen-prefix forgery is required, which is is materially stronger than the BlastRADIUS family (CVE-2024-3596), in which an attacker must still forge a valid authenticator.

Successful exploitation yields pre-authentication impersonation of any RADIUS-mapped user in any affected realm. The resulting session is indistinguishable from a legitimate RADIUS login and carries the named principal's privileges.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

AnalysisAI

Unauthenticated authentication bypass in OpenAM Community Edition (Open Identity Platform fork) through version 16.0.6 lets a network attacker spoof a RADIUS Access-Accept response and obtain a valid OpenAM session for any RADIUS-mapped username, without knowing the shared secret. The flaw stems from the RADIUS client accepting the first inbound UDP datagram as authoritative while skipping source, identifier, and Response Authenticator checks, making it materially easier to exploit than BlastRADIUS (CVE-2024-3596) since no MD5 chosen-prefix forgery is needed. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is confirmed in version 16.1.1.

Technical ContextAI

OpenAM is an open-source access management / SSO and identity federation platform maintained by the Open Identity Platform community (a fork of the former ForgeRock/Sun OpenAM). The affected component is its RADIUS authentication module (Maven artifact org.openidentityplatform.openam:openam-radius), which acts as a RADIUS client validating user logins against an upstream RADIUS server over UDP. The root cause is CWE-347 (Improper Verification of Cryptographic Signature): the client opens an unconnected datagram socket and treats the first datagram on its source port as the authoritative reply. It fails to validate the responder's source IP/port, does not correlate the RADIUS response identifier to the outstanding request, and never verifies the RFC 2865 §3 Response Authenticator; the RFC 2869 Message-Authenticator is neither sent nor required. Because any packet that is not an Access-Reject or Access-Challenge is treated as success, a forged Access-Accept is accepted as a legitimate authentication, yielding a session bound to whatever username the attacker chose.

RemediationAI

Vendor-released patch: OpenAM Community Edition 16.1.1 - upgrade to this version or later (release: https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1), which also bundles numerous unrelated dependency CVE fixes. If immediate upgrade is not possible, the most effective compensating control is to disable or remove any RADIUS module instance from active login chains, since the vulnerability is only reachable when RADIUS authentication is enabled (trade-off: users relying on RADIUS-backed login lose that method until patched). Where RADIUS must stay enabled, restrict the network path between the OpenAM RADIUS client and its RADIUS server - place them on an isolated segment and use host/firewall rules so only the legitimate RADIUS server IP can deliver UDP packets to the OpenAM client's source port (trade-off: source-IP filtering still does not stop a true on-path attacker and adds firewall management overhead). Monitor for duplicate or unexpected Access-Accept traffic to the client port as a detection aid. Refer to advisory GHSA-386j-6m86-78f9 for authoritative guidance.