Which versions of OpenAM's OAuth2 are affected by CVE-2026-47426?

OpenAM Community Edition (through 16.0.6) contains an identity-spoofing flaw that allows a legitimate but low-privileged OAuth2 client to impersonate other OAuth2 clients - including those in…. A patch is available.

How to fix or mitigate CVE-2026-47426?

Within 24 hours, inventory all OpenAM Community Edition deployments and confirm whether any are running 16.0.6 or earlier, and identify which of them host OAuth2 clients using private_key_jwt authentication with jwks_uri-published keys - particularly multi-realm environments; if immediate patching is not possible, restrict or disable private_key_jwt client authentication for non-essential clients and review access token issuance logs for tokens issued to client identifiers inconsistent with the requesting client. Within 7 days, upgrade all affected instances to OpenAM Community Edition 16.1.1 (the vendor-released fixed version) in a test environment first, then schedule production rollout, and rotate signing keys and client credentials for any clients whose tokens may have been impersonated. Within 30 days, complete production upgrades across all remaining environments, validate that the RFC 7523 iss/sub equals client_id check is enforced, and strengthen monitoring for anomalous cross-realm client authentication events.

OpenAM's OAuth2 CVE-2026-47426

Q: What is the CVSS score of CVE-2026-47426?

CVE-2026-47426 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-78368 HIGH

Improper Authentication (CWE-287)

2026-06-29 https://github.com/OpenIdentityPlatform/OpenAM

GHSA-f2cx-463q-7m2c

Authentication Bypass

7.6

CVSS 4.0 · Vendor: https://github.com/OpenIdentityPlatform/OpenAM

Severity by source

Vendor (https://github.com/OpenIdentityPlatform/OpenAM) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Network token endpoint (AV:N), no special complexity (AC:L); attacker needs a registered client so PR:L; impersonation across other clients/realms is a scope change (S:C) with high confidentiality and integrity impact, no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (https://github.com/OpenIdentityPlatform/OpenAM).

CVSS VectorVendor: https://github.com/OpenIdentityPlatform/OpenAM

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Sep 15, 2026 - 10:33 vuln.today

Analysis Updated

Sep 15, 2026 - 10:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 15, 2026 - 10:22 vuln.today

cvss_changed

CVSS changed

Sep 15, 2026 - 10:22 NVD

7.6 (HIGH)

Analysis Generated

Jun 29, 2026 - 18:20 vuln.today

DescriptionCVE.org

Summary

Description

An Improper Authentication (CWE-287) issue in OpenAM's OAuth2 private_key_jwt client authentication path allows any registered OAuth2 client to mint tokens in the name of any other client whose key is published via a jwks_uri, without knowing the victim's signing key. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.

Impact

OpenAM Community Edition deployments through version 16.0.6 that have OAuth2 clients configured for private_key_jwt authentication with keys published via jwks_uri are potentially affected. An attacker holding any such client registration, their own, or one obtained through open dynamic client registration where enabled, can mint access tokens in any other such client's name, in any realm hosted by the OpenAM process.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

AnalysisAI

OAuth2 client impersonation in OpenAM Community Edition (through 16.0.6) lets any holder of a registered OAuth2 client that uses private_key_jwt authentication mint access tokens bearing the identity of any other client whose keys are published through a jwks_uri — including clients in other realms hosted by the same OpenAM process — without possessing the victim client's signing key. The root cause is a shared JWKS resolver cache keyed only by a JWT issuer string, combined with a missing RFC 7523 check that the assertion's iss and sub claims both equal the client_id. The issue is rated 7.6 (CVSS 4.0, AT:P/PR:L, high confidentiality and integrity impact) and was fixed in OpenAM Community Edition 16.1.1; no public exploit code or CISA KEV listing was observed at time of analysis.