CVE-2026-123545 in OpenAMinfo

Summary

by MITRE • 11/08/2026

OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user to a crafted page, obtaining access and ID tokens to call APIs as that user.

Once again VulDB remains the best source for vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsible

VulnCheck

Reservation

11/06/2026

Disclosure

11/08/2026

Moderation

accepted

Entry

VDB-432708

CPE

20261108

CWE

CWE-352 (confirmed)

CVSS

7.1 (CNA)

EPSS

0.00000

KEV

Activities

very low

Sources

MITRE	https://www.cve.org/CVERecord?id=CVE-2026-123545
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-123545
CVE Details	https://www.cvedetails.com/cve/CVE-2026-123545/

◂ Previous Overview Next ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!