{"id":"CVE-2026-123545","kind":"vulnerability","aliases":["CVE-2026-123545"],"related":[],"title":"OpenAM: cross-site request forgery in OAuth device flow exposes user tokens","description":"OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user to a crafted page, obtaining access and ID tokens to call APIs as that user.","summary":"OpenAM's OAuth 2.0 device authorization flow can be abused through cross-site request forgery when consent is skipped for implied-consent clients. A lured logged-in user can have an attacker's device code approved, giving the attacker access and ID tokens to call APIs as that user.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","oauth","openam","other","self-hosted"],"not_affected_if":["no-device-flow","no-implied-consent-clients","outside-affected-versions"],"how_to_check":"- Check the installed OpenAM version, e.g. the version shown in the admin console, and compare it with the affected range 14.5.1 to before 16.1.4.\n- Check whether the OAuth 2.0 device authorization grant is enabled and whether any clients use implied consent, per the vendor advisory.","fix":"- OpenAM: move to `16.1.4` or later, per the product range in the advisory.","status":"open","published_at":"2026-11-08T02:16:45+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","triaged_at":"2026-11-08T02:23:26+00:00","updated_at":"2026-11-08T02:23:26+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-08T02:23:26Z","model":"claude-haiku-5-5","output":{"fix":"- OpenAM: move to `16.1.4` or later, per the product range in the advisory.","reach":"internet","title":"OpenAM: cross-site request forgery in OAuth device flow exposes user tokens","impact":"high","summary":"OpenAM's OAuth 2.0 device authorization flow can be abused through cross-site request forgery when consent is skipped for implied-consent clients. A lured logged-in user can have an attacker's device code approved, giving the attacker access and ID tokens to call APIs as that user.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openam","oauth","identity","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker obtains access and ID tokens for a logged-in user","analyst_note":"","how_to_check":"- Check the installed OpenAM version, e.g. the version shown in the admin console, and compare it with the affected range 14.5.1 to before 16.1.4.\n- Check whether the OAuth 2.0 device authorization grant is enabled and whether any clients use implied consent, per the vendor advisory.","plain_action":"","needs_analyst":false,"not_affected_if":["outside-affected-versions","no-device-flow","no-implied-consent-clients"],"who_is_affected":"OpenAM deployments from 14.5.1 before 16.1.4 that use the OAuth 2.0 device authorization flow with implied-consent clients are exposed. Deployments on other versions, or without the device flow and implied-consent clients, are less exposed. The sources do not say whether managed or hosted OpenAM instances are patched by their operators.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4305,"output_tokens":606,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123545':16A,19A '-2026':15A,18A '14.5.1':81C '16.1.4':83C '2.0':30B,95C 'abus':36B 'access':69B,133C 'allow':100C 'api':75B,139C 'approv':65B,103C 'attack':61B,68B,101C,115C 'author':32B,97C,120C 'call':74B,138C 'client':51B,114C 'code':64B,105C 'consent':44B,50B,107C,113C 'contain':84C 'craft':130C 'cross':3A,39B,87C 'cross-sit':2A,38B,86C 'cve':14A,17A 'devic':9A,31B,63B,96C,104C,119C 'expos':11A 'flow':10A,33B,98C 'forgeri':6A,42B,90C 'give':66B 'host':26B 'id':71B,135C 'ident':20B 'impli':49B,112C 'implied-cons':48B,111C 'log':55B,125C 'logged-in':54B,124C 'lure':53B,122C 'oauth':8A,21B,29B,94C 'obtain':132C 'openam':1A,22B,27B,79C 'page':131C 'request':5A,41B,89C 'self':25B 'self-host':24B 'site':4A,40B,88C 'skip':46B,109C 'start':117C 'token':13A,72B,136C 'user':12A,57B,78B,127C,142C 'vulner':91C","nicknames":[],"mitigations":[],"who_affected":"OpenAM deployments from 14.5.1 before 16.1.4 that use the OAuth 2.0 device authorization flow with implied-consent clients are exposed. Deployments on other versions, or without the device flow and implied-consent clients, are less exposed. The sources do not say whether managed or hosted OpenAM instances are patched by their operators.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","identity","oauth","openam","other","selfhosted"],"campaign_type":null,"search_a":"'-123545':16A,19A '-2026':15A,18A 'cross':3A 'cross-sit':2A 'cve':14A,17A 'devic':9A 'expos':11A 'flow':10A 'forgeri':6A 'oauth':8A 'openam':1A 'request':5A 'site':4A 'token':13A 'user':12A","search_b":"'2.0':30B 'abus':36B 'access':69B 'api':75B 'approv':65B 'attack':61B,68B 'author':32B 'call':74B 'client':51B 'code':64B 'consent':44B,50B 'cross':39B 'cross-sit':38B 'devic':31B,63B 'flow':33B 'forgeri':42B 'give':66B 'host':26B 'id':71B 'ident':20B 'impli':49B 'implied-cons':48B 'log':55B 'logged-in':54B 'lure':53B 'oauth':21B,29B 'openam':22B,27B 'request':41B 'self':25B 'self-host':24B 'site':40B 'skip':46B 'token':72B 'user':57B,78B","search_c":"'14.5.1':81C '16.1.4':83C '2.0':95C 'access':133C 'allow':100C 'api':139C 'approv':103C 'attack':101C,115C 'author':97C,120C 'call':138C 'client':114C 'code':105C 'consent':107C,113C 'contain':84C 'craft':130C 'cross':87C 'cross-sit':86C 'devic':96C,104C,119C 'flow':98C 'forgeri':90C 'id':135C 'impli':112C 'implied-cons':111C 'log':125C 'logged-in':124C 'lure':122C 'oauth':94C 'obtain':132C 'openam':79C 'page':131C 'request':89C 'site':88C 'skip':109C 'start':117C 'token':136C 'user':127C,142C 'vulner':91C","first_public_at":"2026-10-22T09:10:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123545","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123545","severity":null,"published_at":"2026-11-08T02:16:45+00:00","modified_at":"2026-11-08T02:16:45+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","fetched_at":"2026-11-08T02:21:10+00:00","note":null}],"documents":[{"id":99239,"url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-545c-rm35-2jj2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T09:10:56+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99240,"url":"https://www.vulncheck.com/advisories/openam-14.5.1-before-16.1.4-csrf-in-oauth-2.0-device-flow","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}