CVE-2026-45052 in OpenAM
Summary
by MITRE • 09/15/2026
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenticated remote requests to write persistent entries through SOAPReceiver and DiscoveryService into a user's Liberty Discovery store and the shared root-realm Discovery branch. The server-side handlers bypass requester LDAP and identity ACLs, and the global path uses an internal administrative token. Deployments that consume Liberty discovery data can subsequently use manipulated service-routing or security-mechanism records. This issue is fixed in version 16.1.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within Oracle Open Access Management, specifically affecting versions prior to 16.1.1, represents a critical failure in access control mechanisms governing the Liberty Web Services SOAP receiver. This flaw allows unauthenticated remote attackers to inject persistent entries into user-specific Liberty Discovery stores and shared root-realm Discovery branches via SOAPReceiver and DiscoveryService endpoints. The core technical deficiency lies in the server-side handlers which fail to enforce standard LDAP-based identity Access Control Lists (ACLs) or requester authentication requirements for these specific operations. By bypassing these fundamental security checks, the system inadvertently trusts incoming requests that should be subject to strict administrative validation, effectively treating unauthenticated traffic with the same privilege level as authorized internal administrative processes utilizing an internal administrative token.
From a technical perspective, this vulnerability exploits the trust relationship between the SOAP receiver and the underlying discovery service infrastructure. The Liberty Discovery store is designed to maintain configuration data related to service routing and security mechanisms for OpenAM deployments. When an attacker successfully writes arbitrary entries into these stores without authentication, they can manipulate how services are discovered and routed within the environment. This manipulation does not require prior credentials or successful login sessions, making it a remote code execution vector in terms of configuration integrity rather than direct system command injection. The persistence aspect is particularly dangerous because the injected data remains in the store until explicitly removed, allowing for long-term impact even after the initial exploitation attempt has concluded.
The operational impact of this vulnerability extends beyond simple unauthorized access to include severe service disruption and potential privilege escalation within the identity management ecosystem. Attackers can alter service-routing records to redirect authentication requests or token validation processes through malicious intermediaries, facilitating man-in-the-middle attacks against legitimate users. Furthermore, by modifying security-mechanism records, an attacker could potentially weaken cryptographic protections or disable specific authentication modules for targeted realms. This compromises the integrity of the entire identity and access management framework, as downstream applications relying on Liberty discovery data will operate based on corrupted configuration states, leading to unpredictable behavior, denial of service, or complete bypass of intended security controls.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if the internal administrative token is considered a static secret value exposed through improper channel usage. In terms of MITRE ATT&CK framework classification, this behavior corresponds to T1505 Server Software Component which involves installing or creating persistent backdoors such as web shells or other components that allow for continued access and manipulation of system configurations. The exploitation technique also reflects aspects of T1136 Create Account if the attacker creates new administrative entries, though the primary impact here is configuration tampering rather than account creation per se.
Mitigation strategies must prioritize immediate patching to version 16.1.1 or later where these access control checks have been properly implemented and validated by Oracle engineering teams. For environments unable to upgrade immediately due to compatibility constraints, network-level segmentation should be enforced to restrict SOAP endpoint accessibility exclusively to trusted internal subnets that host legitimate Liberty discovery consumers. Additionally, implementing strict input validation on all incoming SOAP requests and enabling comprehensive logging for DiscoveryService operations can aid in detecting attempted exploitation activities. Security teams should also audit existing configurations for any signs of unauthorized modifications to the root-realm or user-specific discovery stores as a post-incident response measure.