Which versions of OpenAM are affected by CVE-2026-46623?

OpenAM Community Edition through version 16.0.6 contains an unauthenticated authentication bypass vulnerability allowing account takeover of any user who has authenticated via the OAuth2 module,…. A patch is available.

How to fix or mitigate CVE-2026-46623?

Within 24 hours: Inventory all OpenAM instances running version 16.0.6 or earlier with OAuth2 module enabled; disable OAuth2 if operationally feasible. Within 7 days: Implement dedicated monitoring and alerting on OpenAM authenticate endpoints for suspicious login patterns; enforce network-level restrictions limiting access to trusted segments only. Within 30 days: Monitor OpenIdentity Platform security advisories for patch release; evaluate migration to alternative identity platforms if OpenAM is non-critical, or plan upgrade path once patch becomes available.

OpenAM CVE-2026-46623

HIGH

Unverified Password Change (CWE-620)

2026-06-26 https://github.com/OpenIdentityPlatform/OpenAM

GHSA-gf57-4mp6-m85x

Information Disclosure

Severity by source

vuln.today AI

7.4 HIGH

Remote unauthenticated against a public endpoint (AV:N/PR:N/UI:N); AC:H because exploitation depends on the victim having completed prerequisite OAuth2 logins outside attacker control; full account takeover gives C:H/I:H, no direct availability loss.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

Source Code Evidence Fetched

Jun 26, 2026 - 18:15 vuln.today

Analysis Generated

Jun 26, 2026 - 18:15 vuln.today

DescriptionCVE.org

Summary

Description

An Unverified Password Change (CWE-620) and Use of Weak Credentials (CWE-1391) issue in OpenAM's OAuth2 authentication module silently rewrites a local user's password to the literal string of their username on OAuth2 re-login of an existing account. The default ldapService chain then accepts the username as the password for that user, allowing an unauthenticated attacker to obtain a session via the standard authenticate endpoint with both username and password set to the username, without any IdP interaction. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.

Impact

OpenAM Community Edition deployments through version 16.0.6 that use the OAuth2 authentication module with account creation enabled (the default) are potentially affected. After two OAuth logins of a given user, that user's local password becomes their username, and the account is reachable through the default ldapService chain with username as both identifier and password. For pre-existing users whose IdP profile resolves against an existing local identifier, the rewrite fires on the very first re-login.

Usernames shorter than the default minimum password length have the rewrite silently denied (so very short administrative accounts are not affected), and the same update path marks accounts active on every OAuth login, silently reactivating disabled accounts.

Successful exploitation grants an unauthenticated attacker a session carrying the victim principal's privileges.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

AnalysisAI

Authentication bypass and account takeover in OpenAM Community Edition (OpenIdentity Platform) through 16.0.6 allows unauthenticated attackers to log in as any user who has authenticated via the OAuth2 module. The OAuth2 module silently rewrites a local user's password to the literal value of their own username, after which the default ldapService chain accepts the username as both identifier and password at the standard authenticate endpoint - no IdP interaction needed. No public exploit identified at time of analysis, but the attack requires only knowledge of a target username once the password-rewrite has fired.

Technical ContextAI

OpenAM is an open-source identity and access management server (an OpenIdentity Platform fork of ForgeRock/Sun OpenAM) providing SSO, federation, and OAuth2/OpenID Connect services; the affected component is the openam-auth-oauth2 Maven module (pkg:maven/org.openidentityplatform.openam:openam-auth-oauth2). The root cause is CWE-620 (Unverified Password Change) compounded by CWE-1391 (Use of Weak Credentials): on OAuth2 re-login with account creation enabled, the module's account-update path writes the user's username into the local password attribute without any verification, producing a credential that is trivially guessable. Because the default ldapService authentication chain validates that local password, the rewritten 'username=password' pair becomes a valid login. The same update path also flips the account status to active on every OAuth login, silently reactivating disabled accounts.

RemediationAI

Vendor-released patch: upgrade to OpenAM Community Edition 16.1.1 or later, which corrects the OAuth2 module's password-rewrite behavior - this is the primary and authoritative fix per advisory GHSA-gf57-4mp6-m85x (https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-gf57-4mp6-m85x). Where immediate upgrade is not possible, the most direct compensating control is to disable the OAuth2 authentication module's account-creation/account-update behavior so the password-rewrite path is never invoked (side effect: just-in-time provisioning of new federated users stops, requiring pre-provisioned accounts). Additional interim controls include forcing a password reset for any user who has authenticated via OAuth2 (so no account is left with password equal to its username), and restricting or monitoring the ldapService authenticate endpoint for logins where the submitted username equals the submitted password (side effect: may flag legitimate but weak passwords). These workarounds reduce exposure but do not address the underlying flaw, so upgrading to 16.1.1 remains required.