CVE-2026-105117 in OpenAM
Summary
by MITRE • 10/03/2026
OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/{realm}/users. Attackers can supply subject and message fields to send phishing mail from the organisation's configured From address, or abuse register as a relay to arbitrary recipients.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified in ForgeRock OpenAM versions prior to 16.1.3 represents a critical email content injection flaw that stems from insufficient validation of user-supplied input within the authentication and registration workflows. Specifically, this security defect resides in the JSON API endpoints responsible for handling password recovery via the forgotPassword action and new account creation via the register action under the /json/{realm}/users path. The core technical issue arises because these endpoints accept arbitrary parameters from unauthenticated users without properly sanitizing or escaping them before embedding into outgoing notification emails. This lack of input validation allows an attacker to inject malicious content directly into the email headers, particularly targeting the subject line and message body fields that are dynamically populated by the application logic during password reset or registration confirmation processes.
From a technical perspective, this vulnerability is classified under CWE-134: Use of Externally-Controlled Format String in Email Header Injection, which falls broadly within the category of injection flaws where untrusted data is sent to an interpreter as part of a command or query. In the context of OpenAM, the application constructs email messages by concatenating user-provided strings with static template text. Because these inputs are not properly encoded or validated against expected formats such as alphanumeric characters only, attackers can manipulate the structure of the email headers. This manipulation enables them to override default values for critical fields like the subject line and the body content, effectively taking control over what the end-user recipient sees when they receive a notification from the organization's configured From address.
The operational impact of this vulnerability is severe due to its potential for facilitating sophisticated social engineering attacks. Since OpenAM typically sends emails using an organizational domain as the sender identity, attackers can exploit this trust relationship by crafting phishing messages that appear legitimate and authoritative. By controlling the subject line and message body, malicious actors can create convincing fake password reset requests or account verification prompts designed to steal credentials from unsuspecting users. Furthermore, because the register action allows for arbitrary recipient specification in some configurations, the vulnerability also enables abuse as an open relay mechanism. This means attackers could potentially use the OpenAM instance to send spam or phishing emails to external targets who have no legitimate relationship with the organization hosting the identity management system, thereby damaging organizational reputation and triggering blacklisting of the domain by email providers.
This attack vector aligns closely with MITRE ATT&CK technique T1566.002: Spearphishing Link, as well as aspects of T1598: Phishing for Information or Credentials through Email Content Injection. The ability to control both the subject and body allows attackers to craft highly targeted spear-phishing campaigns that bypass basic spam filters which might otherwise flag generic malicious content. Additionally, the use of a trusted organizational domain increases the likelihood of successful credential harvesting because recipients are more likely to trust emails appearing to originate from their own company's identity provider or IT department.
Mitigation strategies must focus on immediate patching and robust input validation practices. Organizations running OpenAM versions earlier than 16.1.3 should upgrade to the latest stable release where this issue has been resolved through strict parameter sanitization and output encoding mechanisms. In addition to upgrading, administrators should implement web application firewall rules that detect and block anomalous patterns in email-related API requests, such as unusual characters or encoded payloads within subject and message parameters. It is also advisable to review logging configurations to ensure that all attempts to interact with the forgotPassword and register endpoints are monitored for signs of exploitation attempts. Long-term remediation should include adopting secure coding standards that mandate input validation at every layer of the application stack, ensuring that user-supplied data is never directly embedded into sensitive contexts like email headers without rigorous sanitization checks compliant with industry best practices for preventing injection vulnerabilities.