CVE-2026-123542 · Infrastructure
NO FIX YET · SEE WHAT TO DO
OpenAM before 16.1.4 does not enforce PKCE in the OAuth 2.0 device authorization flow, so the code verifier is never checked when device codes are exchanged for tokens. An attacker who obtains an approved device code from client logs or shared device storage can redeem it for access and ID tokens and impersonate the user.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running OpenAM before 16.1.4 that use the OAuth 2.0 device authorization flow. The risk depends on device codes leaking through client logs or shared device storage. Deployments without the device flow in use are likely less exposed; the sources do not say more.
Not affected if device-flow-unused, openam-16.1.4-or-later
Who cares identity, oauth, openam, sso
16.1.4 are affected.16.1.4 or later.OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code verifier when device codes are exchanged for tokens. Attackers who obtain an approved device code from client logs or shared device storage can redeem it for access and ID tokens to impersonate the user.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.