OpenAM CVE-2026-46560
HIGH
GHSA-386j-6m86-78f9
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Off-path attacker sprays forged packets with no source/authenticator check, so AV:N/PR:N; timing race against the real server keeps AC:H; full session impersonation gives C:H/I:H but no direct availability loss (A:N).
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionGitHub Advisory
Summary
Description
An Improper Verification of Cryptographic Signature (CWE-347) issue in OpenAM's RADIUS authentication module allows an unauthenticated network attacker to spoof an Access-Accept response and obtain an OpenAM session for any RADIUS username, without knowing the configured shared secret. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.
The RADIUS client opens an unconnected datagram socket and treats the first UDP datagram delivered to its source port as authoritative. The receive path does not check the source IP/port, does not match the response identifier to the outstanding request, and does not verify the Response Authenticator (RFC 2865 §3); the RFC 2869 Message-Authenticator is neither sent nor required. Any non-Reject/non-Challenge packet is treated as success, so a forged Access-Accept is accepted as a valid login.
Impact
OpenAM Community Edition deployments through version 16.0.6 where an administrator has enabled a RADIUS module instance on a login chain are potentially affected. An attacker either races the real server on-path, or off-path sprays forged Access-Accept packets at the OpenAM client port. Because the client performs no verification of the response authenticator, no MD5 chosen-prefix forgery is required, which is is materially stronger than the BlastRADIUS family (CVE-2024-3596), in which an attacker must still forge a valid authenticator.
Successful exploitation yields pre-authentication impersonation of any RADIUS-mapped user in any affected realm. The resulting session is indistinguishable from a legitimate RADIUS login and carries the named principal's privileges.
Patch
This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.
AnalysisAI
Unauthenticated authentication bypass in OpenAM Community Edition (Open Identity Platform fork) through version 16.0.6 lets a network attacker spoof a RADIUS Access-Accept response and obtain a valid OpenAM session for any RADIUS-mapped username, without knowing the shared secret. The flaw stems from the RADIUS client accepting the first inbound UDP datagram as authoritative while skipping source, identifier, and Response Authenticator checks, making it materially easier to exploit than BlastRADIUS (CVE-2024-3596) since no MD5 chosen-prefix forgery is needed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that an OpenAM administrator has enabled a RADIUS authentication module instance on a login chain - without an active RADIUS module the vulnerable code path is unreachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals partly conflict and warrant independent judgement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on a network path to an OpenAM instance configured with a RADIUS login module submits a login for a target username (e.g., an administrator), then either races the genuine RADIUS server on-path or off-path floods spoofed Access-Accept UDP packets at the OpenAM client's source port. Because OpenAM verifies neither the packet source nor the Response Authenticator, the forged accept is honored and the attacker is issued a valid OpenAM session as that user. … |
| Remediation | Vendor-released patch: OpenAM Community Edition 16.1.1 - upgrade to this version or later (release: https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1), which also bundles numerous unrelated dependency CVE fixes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems running OpenAM Community Edition 16.0.6 or earlier with RADIUS authentication enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today