{"id":"CVE-2026-46498","kind":"vulnerability","aliases":["CVE-2026-46498","GHSA-cj8f-2fhf-826r"],"related":[],"title":"OpenAM Arbitrary OAuth Token Minting via Push Registration","description":"## Summary\n\n**Description**\n\nAn Authorization Bypass Through User-Controlled Key (CWE-639) exists in OpenAM's stateful OAuth2 token-read path. Under certain conditions, this may allow an attacker to forge OAuth2 bearer tokens and OIDC ID tokens with arbitrary subject, client, realm, and scope. This affects OpenAM Community Edition through version 16.0.6.\n\nThe OAuth2 token-read path reads caller-supplied token identifiers from the shared Core Token Store (CTS) without placing them in an OAuth-only namespace and without binding the row's trusted CTS type to the expected OAuth token family, so any CTS row whose BLOB claims to be an OAuth token is accepted on the read path with no integrity check.\n\n## Impact\n\nOpenAM Community Edition deployments through version 16.0.6 with the OAuth2 Provider service enabled in a realm are potentially affected, but the vulnerable read path is only reachable once an attacker can place attacker-controlled JSON into the shared CTS under an identifier they know. For example, an anonymous Push Notification SNS callback handler, reachable by any low-privileged user in a Push Notification-enabled realm after a single legitimate Push registration can trigger the exploit.\n\nIn any deployment where such a primitive exists, an attacker can forge OAuth2 bearer tokens with attacker-chosen userName, clientID, realm, and scope. The compromise does not by itself create an OpenAM SSO session or grant admin-console access.\n\n## Patch\n\nThis has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.","summary":"OpenAM's OAuth2 token-read path accepts attacker-written rows from the shared token store as valid tokens, with no integrity check. An attacker who can plant such a row can mint bearer and OIDC ID tokens for any subject, client, realm, or scope.","severity":"high","cvss":7.6,"epss":0.00414,"exploited":false,"exploited_at":null,"products":[{"name":"org.openidentityplatform.openam:openam-oauth2","fixed":["16.1.1"],"affected":"< 16.1.1","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["cwe-639","oauth2","oidc","openam","package","self-hosted"],"not_affected_if":["default-config","no-oauth2-provider","no-push-notification"],"how_to_check":"- Check the openam-oauth2 version in your Maven dependencies, e.g. `mvn dependency:list | grep openam-oauth2`\n- Confirm whether the OAuth2 Provider service is enabled in any realm and whether Push Notification is enabled there\n- unknown whether other checks are needed","fix":"- Upgrade `openam-oauth2` to `16.1.1` or later\n- unknown whether a configuration workaround exists","status":"open","published_at":"2026-06-25T17:07:58+00:00","first_seen_at":"2026-10-28T15:29:41+00:00","triaged_at":"2026-10-28T15:30:54+00:00","updated_at":"2026-10-28T15:33:37+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T15:30:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `openam-oauth2` to `16.1.1` or later\n- unknown whether a configuration workaround exists","reach":"internet","title":"OpenAM: forged OAuth tokens let attackers impersonate any user","impact":"high","summary":"OpenAM's OAuth2 token-read path accepts attacker-written rows from the shared token store as valid tokens, with no integrity check. An attacker who can plant such a row can mint bearer and OIDC ID tokens for any subject, client, realm, or scope.","category":"package","nicknames":[],"who_cares":["openam","self-hosted","oauth2","oidc"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker forges OAuth2 and OIDC tokens for arbitrary users and clients","analyst_note":"","how_to_check":"- Check the openam-oauth2 version in your Maven dependencies, e.g. `mvn dependency:list | grep openam-oauth2`\n- Confirm whether the OAuth2 Provider service is enabled in any realm and whether Push Notification is enabled there\n- unknown whether other checks are needed","needs_analyst":false,"not_affected_if":["default-config","no-oauth2-provider","no-push-notification"],"who_is_affected":"OpenAM Community Edition through `16.0.6` with the OAuth2 Provider service enabled in a realm is affected. The advisory says the vulnerable path is reachable only once an attacker can place attacker-controlled JSON into the shared CTS under an identifier they know, for example through an anonymous Push Notification SNS callback after a legitimate Push registration. Deployments without that primitive are described as potentially unaffected, and the compromise does not by itself grant SSO sessions or admin-console access.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000705,"input_tokens":3820,"output_tokens":645,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,18A '-46498':11A,19A '-639':25B,90C '16.0.6':132C,205C '16.1.1':328C '2fhf':15A '826r':16A 'accept':40B,189C 'access':317C 'admin':315C 'admin-consol':314C 'affect':126C,217C 'allow':106C 'anonym':247C 'arbitrari':2A,119C 'attack':42B,58B,108C,228C,232C,286C,294C 'attacker-chosen':293C 'attacker-control':231C 'attacker-written':41B 'author':82C 'bearer':67B,112C,290C 'bind':163C 'blob':181C 'bypass':83C 'callback':251C 'caller':141C 'caller-suppli':140C 'certain':102C 'check':56B,197C 'chosen':295C 'cj8f':14A 'claim':182C 'client':75B,121C 'clientid':297C 'communiti':128C,200C,325C 'compromis':302C 'condit':103C 'consol':316C 'control':87C,233C 'core':148C 'creat':307C 'cts':151C,168C,178C,238C 'cve':9A,17A 'cwe':24B,89C 'deploy':202C,279C 'descript':80C 'edit':129C,201C,326C 'enabl':211C,265C 'encourag':331C 'exampl':245C 'exist':91C,284C 'expect':172C 'exploit':276C 'famili':175C 'forg':110C,288C 'ghsa':13A 'ghsa-cj8f-2fhf-826r':12A 'grant':313C 'handler':252C 'host':32B 'id':70B,116C 'identifi':144C,241C 'impact':198C 'integr':55B,196C 'json':234C 'key':88C 'know':243C 'latest':336C 'legitim':270C 'low':257C 'low-privileg':256C 'may':105C 'mint':5A,66B 'namespac':160C 'notif':249C,264C 'notification-en':263C 'oauth':3A,158C,173C,186C 'oauth-on':157C 'oauth2':23A,26B,35B,96C,111C,134C,208C,289C 'oidc':27B,69B,115C 'openam':1A,22A,28B,33B,93C,127C,199C,309C,324C 'openam-oauth2':21A 'org.openidentityplatform.openam':20A 'packag':29B 'patch':318C,322C 'path':39B,100C,138C,193C,222C 'place':153C,230C 'plant':61B 'potenti':216C 'primit':283C 'privileg':258C 'provid':209C 'push':7A,248C,262C,271C 'reachabl':225C,253C 'read':38B,99C,137C,139C,192C,221C 'realm':76B,122C,214C,266C,298C 'registr':8A,272C 'releas':337C 'row':44B,64B,165C,179C 'scope':78B,124C,300C 'self':31B 'self-host':30B 'servic':210C 'session':311C 'share':47B,147C,237C 'singl':269C 'sns':250C 'sso':310C 'state':95C 'store':49B,150C 'subject':74B,120C 'summari':79C 'suppli':142C 'token':4A,37B,48B,52B,71B,98C,113C,117C,136C,143C,149C,174C,187C,291C 'token-read':36B,97C,135C 'trigger':274C 'trust':167C 'type':169C 'updat':333C 'user':86C,259C,329C 'user-control':85C 'usernam':296C 'valid':51B 'version':131C,204C,327C 'via':6A 'vulner':220C 'whose':180C 'without':152C,162C 'written':43B","nicknames":[],"mitigations":[],"who_affected":"OpenAM Community Edition through `16.0.6` with the OAuth2 Provider service enabled in a realm is affected. The advisory says the vulnerable path is reachable only once an attacker can place attacker-controlled JSON into the shared CTS under an identifier they know, for example through an anonymous Push Notification SNS callback after a legitimate Push registration. Deployments without that primitive are described as potentially unaffected, and the compromise does not by itself grant SSO sessions or admin-console access.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-25T17:07:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-cj8f-2fhf-826r","url":"https://github.com/advisories/GHSA-cj8f-2fhf-826r","severity":"high","published_at":"2026-06-25T17:07:58+00:00","modified_at":"2026-10-28T15:27:30+00:00","first_seen_at":"2026-10-28T15:29:41+00:00","fetched_at":"2026-10-28T15:29:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-46498","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46498","severity":null,"published_at":"2026-09-15T10:17:04+00:00","modified_at":"2026-09-23T18:21:42+00:00","first_seen_at":"2026-10-28T15:33:37+00:00","fetched_at":"2026-10-28T15:33:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}