---
id: "CVE-2026-123542"
page: "https://infrastack.ai/live/CVE-2026-123542"
kind: "vulnerability"
aliases: ["CVE-2026-123542"]
title: "OpenAM: missing PKCE check lets stolen device codes mint user tokens"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["identity", "infrastructure", "oauth", "openam", "sso"]
not_affected_if: ["device-flow-unused", "openam-16.1.4-or-later"]
published_at: "2026-11-08T02:16:45+00:00"
first_seen_at: "2026-11-08T02:21:10+00:00"
updated_at: "2026-11-08T02:23:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123542", "first_seen_at": "2026-11-08T02:21:10+00:00"}]
exploit_sources: []
---

# OpenAM: missing PKCE check lets stolen device codes mint user tokens

Link for people: https://infrastack.ai/live/CVE-2026-123542 (this .md is for agents)

OpenAM before 16.1.4 does not enforce PKCE in the OAuth 2.0 device authorization flow, so the code verifier is never checked when device codes are exchanged for tokens. An attacker who obtains an approved device code from client logs or shared device storage can redeem it for access and ID tokens and impersonate the user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenAM version in use; versions before `16.1.4` are affected.
- Check whether the OAuth 2.0 device authorization flow is enabled for OpenAM clients.

## Fix

- OpenAM: move to `16.1.4` or later.

## Timeline

- 2026-11-08T02:21:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123542

## Documents

- [advisory] Vendor advisory: github.com https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-h93p-35jm-rj83
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openam-before-16.1.4-pkce-bypass-in-oauth-2.0-device-authorization-flow

## From the sources

OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code verifier when device codes are exchanged for tokens. Attackers who obtain an approved device code from client logs or shared device storage can redeem it for access and ID tokens to impersonate the user.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_