OpenIdentityPlatform OpenAM up to 16.1.0 PKCE AuthorizationCodeGrantTypeHandler code_verifier improper authentication

Summaryinfo

A vulnerability labeled as critical has been found in OpenIdentityPlatform OpenAM up to 16.1.0. Affected is the function AuthorizationCodeGrantTypeHandler of the component PKCE. The manipulation of the argument code_verifier results in improper authentication. This vulnerability is identified as CVE-2026-48717. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in OpenIdentityPlatform OpenAM up to 16.1.0. It has been classified as critical. Affected is the function AuthorizationCodeGrantTypeHandler of the component PKCE. The manipulation of the argument code_verifier with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a code_verifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a code_challenge. Because that setting is disabled by default, an attacker who intercepts a PKCE-protected authorization code can omit code_verifier and redeem the code, while an explicitly incorrect verifier is rejected. Public clients are directly affected, and confidential-client exploitation additionally requires client authentication material or another redemption context. This issue is fixed in version 16.1.1.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-48717 since 05/22/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

Upgrading to version 16.1.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• OpenIdentityPlatform

Name

• OpenAM

Version

• 16.0
• 16.1.0

Website

• Product: https://github.com/OpenIdentityPlatform/OpenAM/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion