CVE-2026-123549 · Infrastructure
NO FIX YET · SEE WHAT TO DO
OpenAM before 16.1.4 does not enforce its list of allowed attributes during self-registration. An anonymous attacker can set restricted fields such as group membership and gain full administrative control.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running OpenAM before 16.1.4 where self-registration is reachable, including via the legacy self-service REST endpoint or User Self-Service flow. Deployments without self-registration exposed may be less exposed, but the sources do not say this is a safe configuration.
Not affected if auth-required, self-registration-disabled
Who cares identity, openam, self-hosted
16.1.4.16.1.4 or later.OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join administrative groups and gain full administrative control of OpenAM.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.