Which versions of OpenAM are affected by EUVD-2026-78369?

OpenAM Community Edition 16.0.6 and earlier allows attackers to impersonate users by stealing OAuth access tokens through an authorization bypass vulnerability.. A patch is available.

How to fix or mitigate EUVD-2026-78369?

Within 24 hours, identify all OpenAM Community Edition deployments running version 16.0.6 or earlier and document which realms have codeVerifierEnforced enabled; simultaneously review OAuth2 token endpoint logs for code redemption events without code_verifier parameters as an indicator of exploitation. Within 7 days, plan staged upgrades to version 16.1.1 or later, beginning with non-production environments, and audit recent access tokens to detect signs of misuse. Within 30 days, complete production deployment of OpenAM 16.1.1 or later across all realms and explicitly enable the codeVerifierEnforced setting at the realm level.

OpenAM EUVD-2026-78369

Q: What is the CVSS score of EUVD-2026-78369?

EUVD-2026-78369 has a CVSS 4.0 base score of 9.1 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-48717 CRITICAL

Improper Authorization (CWE-285)

2026-06-29 https://github.com/OpenIdentityPlatform/OpenAM

GHSA-4v2w-2wqp-mc85

Authentication Bypass Microsoft

9.1

CVSS 4.0 · Vendor: https://github.com/OpenIdentityPlatform/OpenAM

Severity by source

Vendor (https://github.com/OpenIdentityPlatform/OpenAM) PRIMARY

9.1 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.4 HIGH

AC:H because the attacker must first intercept a valid authorization code; PR:N/UI:N for public clients; C:H/I:H from full token theft/impersonation; A:N as availability is unaffected.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/OpenIdentityPlatform/OpenAM).

CVSS VectorVendor: https://github.com/OpenIdentityPlatform/OpenAM

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Sep 15, 2026 - 10:29 vuln.today

Analysis Updated

Sep 15, 2026 - 10:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 15, 2026 - 10:22 vuln.today

cvss_changed

CVSS changed

Sep 15, 2026 - 10:22 NVD

9.1 (CRITICAL)

Analysis Generated

Jun 29, 2026 - 18:21 vuln.today

CVE Published

Jun 29, 2026 - 17:46 cve.org

CRITICAL 9.1

DescriptionCVE.org

Summary

Description

An Improper Authorization (CWE-285) issue in OpenAM's OAuth2 authorization-code grant allows a PKCE-protected authorization code to be redeemed without the required code_verifier. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.

The authorize endpoint stores a code_challenge on the issued code, but the token endpoint only requires a code_verifier when the realm-wide codeVerifierEnforced setting is enabled, which ships disabled by default. With that setting off, the stored challenge is checked only if the caller supplies a verifier, so omitting the parameter skips PKCE verification entirely.

Impact

OpenAM Community Edition deployments through version 16.0.6 using the default OAuth2 provider configuration are potentially affected. For public clients, an attacker who intercepts an authorization code can exchange it for tokens without knowing the verifier. For confidential clients, the attacker additionally needs client authentication material or an execution context that can redeem the code. A token request supplying an incorrect verifier is still rejected. The bypass is specifically the missing-parameter path.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

AnalysisAI

PKCE downgrade / authorization bypass in Open Identity Platform's OpenAM Community Edition (OAuth2 authorization-code grant) through 16.0.6 lets an attacker who intercepts a PKCE-protected authorization code redeem it for tokens by simply omitting the code_verifier parameter. Because the realm-wide codeVerifierEnforced setting ships disabled by default, the token endpoint only validates the stored code_challenge when a verifier is actually supplied, so the missing-parameter path skips verification entirely (CWE-285). No public exploit identified at time of analysis and EPSS is low (0.53%, 43rd percentile); fixed in 16.1.1.

Technical ContextAI

OpenAM is an open-source identity and access management server (the Open Identity Platform fork of ForgeRock OpenAM), here the openam-oauth2 Maven module implementing an OAuth2/OIDC provider. PKCE (RFC 7636) binds an authorization code to a client-generated secret: the authorize endpoint records a code_challenge, and the token endpoint must require the matching code_verifier when the code is redeemed (RFC 7636 §4.6). The root cause (CWE-285, Improper Authorization) is in AuthorizationCodeGrantTypeHandler.handle(): verification was gated solely on providerSettings.isCodeVerifierRequired(), and the challenge-vs-verifier comparison only ran 'if (codeVerifier != null)'. Thus, with enforcement off, an attacker who omits code_verifier entirely never triggers the check, even though the code was issued with a challenge. The fix computes codeWasIssuedWithChallenge from the stored challenge and enforces verification whenever a challenge is present, independent of the provider-wide setting.

RemediationAI

Vendor-released patch: upgrade to OpenAM Community Edition 16.1.1, which enforces code_verifier validation whenever an authorization code was issued with a code_challenge, regardless of provider settings (fix commit 97a34d9fee17395e8e052bfc45eb5855f436153e; release https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/16.1.1; advisory https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-4v2w-2wqp-mc85). If you cannot upgrade immediately, enable the realm-wide Code Verifier Parameter Required (codeVerifierEnforced) property under Realms > Realm Name > Services > OAuth2 Provider > Advanced, which forces all authorization-code requests to supply a code_verifier and closes the missing-parameter path - the trade-off is that any legacy or non-PKCE clients in that realm will break and must be updated to send code_challenge/code_verifier. Additionally, shorten authorization-code lifetime, enforce TLS everywhere, and lock down redirect URIs to reduce the chance of code interception.