Which versions of OpenAM are affected by EUVD-2026-78359?

OpenAM Community Edition (through 16.0.6) allows attackers with Core Token Store database access to forge authentication tokens for any user, enabling account takeover and unauthorized system access.. A patch is available.

How to fix or mitigate EUVD-2026-78359?

24 hours: Identify all OpenAM instances running version 16.0.6 or earlier and assess exposure to Core Token Store write access. 7 days: Upgrade to OpenAM Community Edition 16.1.1 or later. 30 days: Audit access logs for suspicious CTS modifications, validate patch deployment across all systems, and implement monitoring for unusual token creation patterns.

OpenAM EUVD-2026-78359

Q: What is the CVSS score of EUVD-2026-78359?

EUVD-2026-78359 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-46498 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-25 https://github.com/OpenIdentityPlatform/OpenAM

GHSA-cj8f-2fhf-826r

Authentication Bypass

7.6

CVSS 4.0 · Vendor: https://github.com/OpenIdentityPlatform/OpenAM

Severity by source

Vendor (https://github.com/OpenIdentityPlatform/OpenAM) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Network-reachable but gated by a non-default CTS write primitive and prior Push registration (AC:H, PR:L); token forgery impacts relying parties beyond OpenAM (S:C) with high confidentiality/integrity but no availability effect.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (https://github.com/OpenIdentityPlatform/OpenAM).

CVSS VectorVendor: https://github.com/OpenIdentityPlatform/OpenAM

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Sep 15, 2026 - 10:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 15, 2026 - 10:22 vuln.today

cvss_changed

CVSS changed

Sep 15, 2026 - 10:22 NVD

7.6 (HIGH)

Source Code Evidence Fetched

Jun 25, 2026 - 17:31 vuln.today

Analysis Generated

Jun 25, 2026 - 17:31 vuln.today

DescriptionCVE.org

Summary

Description

An Authorization Bypass Through User-Controlled Key (CWE-639) exists in OpenAM's stateful OAuth2 token-read path. Under certain conditions, this may allow an attacker to forge OAuth2 bearer tokens and OIDC ID tokens with arbitrary subject, client, realm, and scope. This affects OpenAM Community Edition through version 16.0.6.

The OAuth2 token-read path reads caller-supplied token identifiers from the shared Core Token Store (CTS) without placing them in an OAuth-only namespace and without binding the row's trusted CTS type to the expected OAuth token family, so any CTS row whose BLOB claims to be an OAuth token is accepted on the read path with no integrity check.

Impact

OpenAM Community Edition deployments through version 16.0.6 with the OAuth2 Provider service enabled in a realm are potentially affected, but the vulnerable read path is only reachable once an attacker can place attacker-controlled JSON into the shared CTS under an identifier they know. For example, an anonymous Push Notification SNS callback handler, reachable by any low-privileged user in a Push Notification-enabled realm after a single legitimate Push registration can trigger the exploit.

In any deployment where such a primitive exists, an attacker can forge OAuth2 bearer tokens with attacker-chosen userName, clientID, realm, and scope. The compromise does not by itself create an OpenAM SSO session or grant admin-console access.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

AnalysisAI

OpenAM Community Edition through 16.0.6 fails to namespace OAuth2 token identifiers in its shared Core Token Store (CTS), allowing attackers who can write JSON rows into the CTS to forge OAuth2 bearer tokens and OIDC ID tokens with arbitrary subject, client, realm, and scope. Exploitation is not universal: the read path only becomes reachable once a CTS-write primitive exists, for example an anonymous Push Notification SNS callback handler that any low-privileged user can reach after one legitimate Push registration, which is reflected in the CVSS 4.0 Attack Requirements metric (AT:P). The flaw is fixed in OpenAM Community Edition 16.1.1 (commit e047b01), and no public exploit code or CISA KEV listing was identified in the supplied intelligence.