EUVD-2026-78369
GHSA-4v2w-2wqp-mc85
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector for public clients needing no auth (PR:N); AC:H for required code interception; UI:R as victim must initiate flow; C:H for token theft, I:L for potential scope-dependent writes, A:N.
Primary rating from Vendor (https://github.com/OpenIdentityPlatform/OpenAM).
CVSS VectorVendor: https://github.com/OpenIdentityPlatform/OpenAM
Lifecycle Timeline
5DescriptionCVE.org
Summary
Description
An Improper Authorization (CWE-285) issue in OpenAM's OAuth2 authorization-code grant allows a PKCE-protected authorization code to be redeemed without the required code_verifier. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.
The authorize endpoint stores a code_challenge on the issued code, but the token endpoint only requires a code_verifier when the realm-wide codeVerifierEnforced setting is enabled, which ships disabled by default. With that setting off, the stored challenge is checked only if the caller supplies a verifier, so omitting the parameter skips PKCE verification entirely.
Impact
OpenAM Community Edition deployments through version 16.0.6 using the default OAuth2 provider configuration are potentially affected. For public clients, an attacker who intercepts an authorization code can exchange it for tokens without knowing the verifier. For confidential clients, the attacker additionally needs client authentication material or an execution context that can redeem the code. A token request supplying an incorrect verifier is still rejected. The bypass is specifically the missing-parameter path.
Patch
This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.
AnalysisAI
We need answer only valid JSON. Need fill fields. Need use provided data. Need not copy paraphrase description exactly. Need product_name. Summary original synthesis. Technical context with CWE, CPE. Risk assessment with all signals CVSS 4.0 vector given. EPSS? Input doesn't include EPSS/KEV/POC. Need maybe no EPSS provided, KEV absent, POC? Not explicitly. Need patch available. Tags Authentication Bypass, Microsoft wrong vendor? OpenAM is OpenIdentityPlatform, not Microsoft. data_quality_flags should include mislabeled_tag for Microsoft. confidence_notes. prevalence etc.
Need derive assessed_cvss_vector? Input has CVSS 4.0 vector with E:X etc. Need independent CVSS 3.1 vector and rationale. Need assessed_cvss40_vector consistent. We can craft based description. Vulnerability: In OpenAM OAuth2 authorization-code grant, when code_challenge stored but token endpoint does not require code_verifier if realm-wide setting disabled default. Attacker who intercepts auth code can redeem without verifier. Public client attacker intercepts code. Confidential needs client auth. CVSS 4.0 provided: AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X etc. For CVSS 3.1: Attack vector network. Complexity high? Because requires intercepting authorization code, missing verifier; but technically possible with network. Privileges required none for public clients? Attacker needs no account? They intercept code. UI none. Scope? Token issuance impact? Confidentiality high? Integrity high? Availability none. C/I? For CVSS 3.1 maybe AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N or C:H/I:H/A:N. But need choose. The C/I impact: redeem code gives tokens, can access resources with user's authority? Forge tokens? C:H I:H. But maybe if attacker obtains code, can impersonate user. We'll set AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. Rationale: Attack complexity high due to code interception and valid code. PR none for public client path; no UI. Need maybe PR:N but requiring intercept code, no account. We'l
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today