{"id":"CVE-2026-123542","kind":"vulnerability","aliases":["CVE-2026-123542"],"related":[],"title":"OpenAM: missing PKCE check lets stolen device codes mint user tokens","description":"OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code verifier when device codes are exchanged for tokens. Attackers who obtain an approved device code from client logs or shared device storage can redeem it for access and ID tokens to impersonate the user.","summary":"OpenAM before 16.1.4 does not enforce PKCE in the OAuth 2.0 device authorization flow, so the code verifier is never checked when device codes are exchanged for tokens. An attacker who obtains an approved device code from client logs or shared device storage can redeem it for access and ID tokens and impersonate the user.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","infrastructure","oauth","openam","sso"],"not_affected_if":["device-flow-unused","openam-16.1.4-or-later"],"how_to_check":"- Check the OpenAM version in use; versions before `16.1.4` are affected.\n- Check whether the OAuth 2.0 device authorization flow is enabled for OpenAM clients.","fix":"- OpenAM: move to `16.1.4` or later.","status":"open","published_at":"2026-11-08T02:16:45+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","triaged_at":"2026-11-08T02:23:20+00:00","updated_at":"2026-11-08T02:23:20+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-08T02:23:20Z","model":"claude-haiku-5-5","output":{"fix":"- OpenAM: move to `16.1.4` or later.","reach":"network","title":"OpenAM: missing PKCE check lets stolen device codes mint user tokens","impact":"high","summary":"OpenAM before 16.1.4 does not enforce PKCE in the OAuth 2.0 device authorization flow, so the code verifier is never checked when device codes are exchanged for tokens. An attacker who obtains an approved device code from client logs or shared device storage can redeem it for access and ID tokens and impersonate the user.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["openam","oauth","sso","identity"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker takes over a user's identity and receives access tokens","analyst_note":"Confirm whether the device authorization flow is enabled by default and whether the vendor advisory at github.com lists additional affected or fixed versions.","how_to_check":"- Check the OpenAM version in use; versions before `16.1.4` are affected.\n- Check whether the OAuth 2.0 device authorization flow is enabled for OpenAM clients.","plain_action":"","needs_analyst":true,"not_affected_if":["openam-16.1.4-or-later","device-flow-unused"],"who_is_affected":"Organizations running OpenAM before 16.1.4 that use the OAuth 2.0 device authorization flow. The risk depends on device codes leaking through client logs or shared device storage. Deployments without the device flow in use are likely less exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4280,"output_tokens":585,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123542':14A,17A '-2026':13A,16A '16.1.4':25B,80C '2.0':33B,88C 'access':70B,122C 'approv':56B,108C 'attack':52B,104C 'author':35B,90C 'check':4A,43B 'client':60B,112C 'code':8A,39B,46B,58B,95C,99C,110C 'cve':12A,15A 'devic':7A,34B,45B,57B,64B,89C,98C,109C,116C 'enforc':28B,83C 'exchang':48B,101C 'fail':81C 'flow':36B,91C 'id':72B,124C 'ident':18B 'imperson':75B,127C 'infrastructur':19B 'let':5A 'log':61B,113C 'mint':9A 'miss':2A 'never':42B,92C 'oauth':20B,32B,87C 'obtain':54B,106C 'openam':1A,21B,23B,78C 'pkce':3A,29B,84C 'redeem':67B,119C 'share':63B,115C 'sso':22B 'stolen':6A 'storag':65B,117C 'token':11A,50B,73B,103C,125C 'user':10A,77B,129C 'valid':93C 'verifi':40B,96C","nicknames":[],"mitigations":[],"who_affected":"Organizations running OpenAM before 16.1.4 that use the OAuth 2.0 device authorization flow. The risk depends on device codes leaking through client logs or shared device storage. Deployments without the device flow in use are likely less exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","identity","infrastructure","oauth","openam","sso"],"campaign_type":null,"search_a":"'-123542':14A,17A '-2026':13A,16A 'check':4A 'code':8A 'cve':12A,15A 'devic':7A 'let':5A 'mint':9A 'miss':2A 'openam':1A 'pkce':3A 'stolen':6A 'token':11A 'user':10A","search_b":"'16.1.4':25B '2.0':33B 'access':70B 'approv':56B 'attack':52B 'author':35B 'check':43B 'client':60B 'code':39B,46B,58B 'devic':34B,45B,57B,64B 'enforc':28B 'exchang':48B 'flow':36B 'id':72B 'ident':18B 'imperson':75B 'infrastructur':19B 'log':61B 'never':42B 'oauth':20B,32B 'obtain':54B 'openam':21B,23B 'pkce':29B 'redeem':67B 'share':63B 'sso':22B 'storag':65B 'token':50B,73B 'user':77B 'verifi':40B","search_c":"'16.1.4':80C '2.0':88C 'access':122C 'approv':108C 'attack':104C 'author':90C 'client':112C 'code':95C,99C,110C 'devic':89C,98C,109C,116C 'enforc':83C 'exchang':101C 'fail':81C 'flow':91C 'id':124C 'imperson':127C 'log':113C 'never':92C 'oauth':87C 'obtain':106C 'openam':78C 'pkce':84C 'redeem':119C 'share':115C 'storag':117C 'token':103C,125C 'user':129C 'valid':93C 'verifi':96C","first_public_at":"2026-10-22T09:22:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123542","severity":null,"published_at":"2026-11-08T02:16:45+00:00","modified_at":"2026-11-08T02:16:45+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","fetched_at":"2026-11-08T02:21:10+00:00","note":null}],"documents":[{"id":99233,"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-h93p-35jm-rj83","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T09:22:19+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99234,"url":"https://www.vulncheck.com/advisories/openam-before-16.1.4-pkce-bypass-in-oauth-2.0-device-authorization-flow","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}