OpenAM CVE-2026-46560

Exploitation requires that an OpenAM administrator has enabled a RADIUS authentication module instance on a login chain - without an active RADIUS module the vulnerable code path is unreachable. The attacker must be able to deliver UDP packets to the OpenAM RADIUS client's source port and must win a timing race within the window of an outstanding authentication request (on-path racing, or off-path spraying forged Access-Accept packets). No shared secret, no valid Response Authenticator, and no MD5 chosen-prefix forgery are needed (unlike BlastRADIUS/CVE-2024-3596), and no authentication or user interaction is required (PR:N/UI:N). Limiting factors: the dependency on a non-default RADIUS module configuration, the need for network reach to the client port, and the race-condition timing requirement (AC:H) that the attacker's forged packet arrive before or instead of the legitimate reply.

Signals partly conflict and warrant independent judgement. The vendor CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 7.5) models an adjacent-network, high-complexity attack, yet the description explicitly describes an off-path attacker who sprays forged Access-Accept packets at the OpenAM client port - behavior more consistent with a network (AV:N) vector, since no source-address check is performed. Complexity remains non-trivial (AC:H) because the attacker must win a timing race against the legitimate server or hit an open request window, but the absence of any authenticator forgery requirement makes this materially easier than BlastRADIUS. There is no EPSS score, SSVC decision, KEV listing, or POC supplied, so exploitation probability cannot be quantified from the data; treat exploitation as plausible-but-unproven. The decisive mitigating factor is exposure: exploitation is only possible where an administrator has actually enabled a RADIUS module instance on a login chain, which bounds the affected population well below the full OpenAM install base. Net assessment: a genuinely high-impact pre-auth bypass (full account impersonation) that is a real priority for the subset running RADIUS auth, but lower urgency for deployments not using the RADIUS module.

An attacker on a network path to an OpenAM instance configured with a RADIUS login module submits a login for a target username (e.g., an administrator), then either races the genuine RADIUS server on-path or off-path floods spoofed Access-Accept UDP packets at the OpenAM client's source port. Because OpenAM verifies neither the packet source nor the Response Authenticator, the forged accept is honored and the attacker is issued a valid OpenAM session as that user. No public exploit code is identified at time of analysis, and exploitation complexity is raised by the timing race (CVSS AC:H).