OpenIdentityPlatform OpenAM up to 16.1.0 OAuthTokenStore improper authentication

Summaryinfo

A vulnerability was found in OpenIdentityPlatform OpenAM up to 16.1.0 and classified as critical. This issue affects some unknown processing of the component OAuthTokenStore. The manipulation results in improper authentication. This vulnerability is known as CVE-2026-46498. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in OpenIdentityPlatform OpenAM up to 16.1.0. Affected is an unknown code of the component OAuthTokenStore. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers from the shared Core Token Store (CTS) without an OAuth-only namespace, and OAuthAdapter accepts a row whose BLOB claims to contain an OAuth token without binding the trusted CTS type or verifying integrity. An attacker who can place controlled JSON in CTS under a known token identifier, such as through Push Registration followed by an anonymous SNS callback in an enabled realm, can mint OAuth bearer tokens and OpenID Connect ID tokens with chosen subject, client, realm, and scope. The flaw does not by itself create an OpenAM SSO session or grant console access. This issue is fixed in version 16.1.1.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-46498 since 05/14/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

Upgrading to version 16.1.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• OpenIdentityPlatform

Name

• OpenAM

Version

• 16.0
• 16.1.0

Website

• Product: https://github.com/OpenIdentityPlatform/OpenAM/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion