Live › vulnerability › CVE-2026-46560
Go to dashboardOpenAM's RADIUS authentication module accepts any UDP reply to its socket as a successful login without checking the response authenticator, source address or identifier. An unauthenticated network attacker can spoof an Access-Accept and obtain an OpenAM session for any RADIUS username.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 15:24 UTC. All times on this page are UTC.
OpenAM Community Edition deployments through that have a RADIUS authentication module enabled on a login chain are exposed. The attacker needs network path to the OpenAM RADIUS client's UDP port, either racing the real RADIUS server or spraying forged packets. Deployments without a RADIUS module in their login chains, or already on , are not affected.
16.0.616.1.1| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.openidentityplatform.openam:openam-radius | maven | < 16.1.1 | 16.1.1 |
openam-radius below 16.1.1 is affected.org.openidentityplatform.openam:openam-radius version in the build.16.1.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Description
An Improper Verification of Cryptographic Signature (CWE-347) issue in OpenAM's RADIUS authentication module allows an unauthenticated network attacker to spoof an Access-Accept response and obtain an OpenAM session for any RADIUS username, without knowing the configured shared secret. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.
The RADIUS client opens an unconnected datagram socket and treats the first UDP datagram delivered to its source port as authoritative. The receive path does not check the source IP/port, does not match the response identifier to the outstanding request, and does not verify the Response Authenticator (RFC 2865 §3); the RFC 2869 Message-Authenticator is neither sent nor required. Any non-Reject/non-Challenge packet is treated as success, so a forged Access-Accept is accepted as a valid login.
OpenAM Community Edition deployments through version 16.0.6 where an administrator has enabled a RADIUS module instance on a login chain are potentially affected. An attacker either races the real server on-path, or off-path sprays forged Access-Accept packets at the OpenAM client port. Because the client performs no verification of the response authenticator, no MD5 chosen-prefix forgery is required, which is is materially stronger than the BlastRADIUS family (CVE-2024-3596), in which an attacker must still forge a valid authenticator.
Successful exploitation yields pre-authentication impersonation of any RADIUS-mapped user in any affected realm. The resulting session is indistinguishable from a legitimate RADIUS login and carries the named principal's privileges.
This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.
This page as .md · .json · in your agent: get_signal("CVE-2026-46560")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.