CVE-2026-48717 in OpenAM
Summary
by MITRE • 09/15/2026
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a code_verifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a code_challenge. Because that setting is disabled by default, an attacker who intercepts a PKCE-protected authorization code can omit code_verifier and redeem the code, while an explicitly incorrect verifier is rejected. Public clients are directly affected, and confidential-client exploitation additionally requires client authentication material or another redemption context. This issue is fixed in version 16.1.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within Open Access Management (OpenAM) prior to version 16.1.1 represents a critical flaw in the implementation of Proof Key for Code Exchange, commonly known as PKCE. PKCE is an extension to the OAuth 2.0 authorization framework designed specifically to prevent authorization code interception attacks, particularly those targeting public clients such as single-page applications and mobile apps that cannot securely store client secrets. The core mechanism relies on the generation of a code challenge during the initial authorization request and the subsequent presentation of a corresponding code verifier when exchanging the authorization code for an access token. This cryptographic binding ensures that only the entity that initiated the login flow can redeem the issued code, thereby mitigating risks associated with URI redirection or network sniffing where attackers might intercept sensitive tokens in transit.
The technical root cause of this vulnerability lies in the conditional logic governing the AuthorizationCodeGrantTypeHandler within OpenAM versions earlier than 16.1.1. The system was designed to enforce the validation of the code_verifier parameter only when a specific realm-wide configuration setting, codeVerifierEnforced, is explicitly enabled. By default, this security control is disabled in standard deployments. Consequently, if an attacker intercepts an authorization code that contains a stored code_challenge from a PKCE-enabled flow, they can successfully redeem that code for an access token by omitting the required code_verifier parameter entirely. The system accepts the redemption request because it does not strictly enforce the presence of the verifier when the global enforcement flag is off, despite the existence of the challenge in the session data. Conversely, if a client provides an explicitly incorrect or mismatched code_verifier, the authentication server correctly rejects the request, highlighting that the issue is specifically one of missing mandatory validation rather than a failure to validate provided values.
The operational impact of this flaw is severe for public clients relying on OpenAM as their identity provider. An attacker capable of intercepting an authorization code through malicious redirects, cross-site scripting attacks targeting the redirect URI handler, or network-level eavesdropping can exploit this misconfiguration to steal user sessions and gain unauthorized access to protected resources without needing any additional authentication credentials. For confidential clients that utilize client secrets for mutual TLS or POST body authentication during token exchange, exploitation is more complex as it requires compromising those additional credentials or finding an alternative redemption context where the verifier check might be bypassed due to similar configuration oversights elsewhere in the system architecture. This effectively nullifies the primary security benefit of PKCE, leaving public clients vulnerable to standard authorization code injection attacks that modern OAuth 2.0 best practices aim to eliminate.
From a classification perspective, this vulnerability aligns with CWE-347: Improper Verification of Cryptographic Signature, as it involves failing to properly verify the cryptographic proof required by the protocol specification. It also maps to MITRE ATT&CK technique T1556.002: Modifying OAuth Tokens, specifically in the context of intercepting and replaying authorization codes without proper validation. The flaw represents a configuration-driven weakness where security controls are not enabled by default, leading to insecure-by-default behavior that exposes users to credential theft and session hijacking attacks.
To mitigate this vulnerability, organizations must upgrade OpenAM to version 16.1.1 or later, which corrects the logic in the AuthorizationCodeGrantTypeHandler to strictly enforce code_verifier validation regardless of the realm-wide setting status when a PKCE flow is detected. For environments where immediate upgrading is not feasible, administrators should manually enable the codeVerifierEnforced setting at the realm level for all realms that support public clients or any flows involving authorization codes susceptible to interception. Additionally, implementing strict redirect URI validation and utilizing state parameters can provide defense-in-depth measures against initial code interception attempts. Regular security audits of OAuth configurations are recommended to ensure that PKCE enforcement is consistently applied across all client types and authentication contexts within the identity management infrastructure.