What is the CVSS score of EUVD-2026-92021?

EUVD-2026-92021 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-92021?

Yes, a patch is available for EUVD-2026-92021. Update the affected software to the latest version immediately.

OpenAM EUVD-2026-92021

| CVE-2026-105117 MEDIUM

Improper Input Validation (CWE-20)

2026-10-03 VulnCheck

GHSA-35wg-cp3w-fh5v

Code Injection Openam

5.3

CVSS 4.0 · Vendor: VulnCheck

View

Vulnerability Assessment

Weakness

CWE

CWE-20

OWASP Top 10:2025

A05:2025 - Injection

ASVS 5.0

V2 - Validation and Business Logic Input validation, allowlisting

Impact

Signals point to a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms an unauthenticated, network-reachable, low-complexity flaw, which raises its accessibility, but technical impact is capped at low confidentiality and low integrity (VC:L/VI:L, VA:N) and requires passive victim interaction (UI:P) since the payoff is a phishing or relayed email that a recipient must actually read and trust. No EPSS score was supplied, so exploitation probability cannot be quantified; this is a MISSING signal. The CVE is NOT in CISA KEV and no public exploit code is referenced in the two advisories, so there is no public exploit identified at time of analysis - do not treat this as actively exploited. The SSVC-style read is: automatable abuse is plausible (the register action can be scripted as a mail relay), but technical impact is partial rather than total, and real-world damage depends on social-engineering success downstream. Net: a legitimate abuse-of-functionality / input-validation defect worth patching on a normal cycle, not a drop-everything CVSS-inflated item - the 5.3 medium score accurately reflects limited direct impact.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 03, 2026

OpenAM versions before 16.1.3 allow unauthenticated attackers to inject arbitrary content into notification emails sent by the forgotPassword and register self-service endpoints (/json/{realm}/users). By supplying subject and message fields, an attacker can craft phishing messages that appear to originate from the organization's configured From address, or misuse the register action to relay email to arbitrary recipients. No public exploit code has been identified at the time of analysis, and the vendor has released version 16.1.3 to address the improper input validation (CWE-20).

RemediationAI

Upgrade to OpenAM 16.1.3 or later (vendor-released patch: 16.1.3). The fix is available from the Open Identity Platform project; see the GitHub security advisory GHSA-mw38-8gr7-c4x2. If immediate upgrade is not possible, restrict access to the /json/{realm}/users endpoint to trusted networks or authenticated users only, though this may impact legitimate self-service password reset and registration functionality. Consider monitoring outbound email for anomalous content, and configure email sending to use a dedicated address with strict DMARC/DKIM policies to reduce phishing effectiveness. Disabling the forgotPassword and register actions entirely would prevent exploitation but removes self-service capabilities.

Affected VersionsENISA

OpenAM 0 <16.1.3

Affected Packages

euvd openam fix: 16.1.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

OpenAM is an open-source identity and access management platform maintained by the Open Identity Platform community. The vulnerability resides in the REST endpoints under /json/{realm}/users that process forgotPassword and register actions. These endpoints accept user-supplied subject and message parameters, which are then embedded into notification emails without proper validation or sanitization (CWE-20). This allows an attacker to control the email content, including the subject line and body, and because the emails are sent from the organization's configured From address, they can be used for phishing. The CVSS 4.0 vector shows network exploitation, no privileges required (PR:N), and low impact on confidentiality and integrity (VC:L/VI:L), with a changed scope for subsequent systems (SC:L/SI:L). The CPE entries indicate that all versions of OpenIdentityPlatform OpenAM before 16.1.3 are affected.

Know when Openam gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

Passive

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

None

Subsequent system: Confidentiality

Low

Subsequent system: Integrity

Low

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Oct 03, 2026 - 15:01 EUVD

DescriptionCVE.org

OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/{realm}/users. Attackers can supply subject and message fields to send phishing mail from the organisation's configured From address, or abuse register as a relay to arbitrary recipients.

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.