---
id: "CVE-2026-46560"
kind: "vulnerability"
aliases: ["CVE-2026-46560", "GHSA-386j-6m86-78f9"]
title: "OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "org.openidentityplatform.openam:openam-radius", "fixed": ["16.1.1"], "affected": "< 16.1.1", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["cwe-347", "identity", "openam", "package", "radius", "self-hosted"]
not_affected_if: ["no-radius-module", "patched-16.1.1"]
published_at: "2026-06-25T17:22:24+00:00"
first_seen_at: "2026-10-28T15:24:36+00:00"
updated_at: "2026-10-28T15:26:36+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-386j-6m86-78f9", "first_seen_at": "2026-10-28T15:24:36+00:00"}]
---

# OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing

OpenAM's RADIUS authentication module accepts any UDP reply to its socket as a successful login without checking the response authenticator, source address or identifier. An unauthenticated network attacker can spoof an Access-Accept and obtain an OpenAM session for any RADIUS username.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.openidentityplatform.openam:openam-radius affected < 16.1.1 fixed 16.1.1

## How to check

- Check the OpenAM version in the deployment: `openam-radius` below `16.1.1` is affected.
- Check whether a RADIUS authentication module is enabled on any login chain in the OpenAM admin console.
- Check the Maven dependency `org.openidentityplatform.openam:openam-radius` version in the build.

## Fix

- Upgrade OpenAM Community Edition to `16.1.1` or later.
- Until upgraded, disable RADIUS authentication modules on login chains where possible.

## Timeline

- 2026-10-28T15:24:36+00:00 ghsa https://github.com/advisories/GHSA-386j-6m86-78f9

## From the sources

## Summary

**Description**

An Improper Verification of Cryptographic Signature (CWE-347) issue in OpenAM's RADIUS authentication module allows an unauthenticated network attacker to spoof an Access-Accept response and obtain an OpenAM session for any RADIUS username, without knowing the configured shared secret. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.

The RADIUS client opens an unconnected datagram socket and treats the first UDP datagram delivered to its source port as authoritative. The receive path does not check the source IP/port, does not match the response identifier to the outstanding request, and does not verify the Response Authenticator (RFC 2865 §3); the RFC 2869 Message-Authenticator is neither sent nor required. Any non-Reject/non-Challenge packet is treated as success, so a forged Access-Accept is accepted as a valid login.

## Impact
OpenAM Community Edition deployments through version 16.0.6 where an administrator has enabled a RADIUS module instance on a login chain are potentially affected. An attacker either races the real server on-path, or off-path sprays forged Access-Accept packets at the OpenAM client port. Because the client performs no verification of the response authenticator, no MD5 chosen-prefix forgery is required, which is is materially stronger than the BlastRADIUS family (CVE-2024-3596), in which an attacker must still forge a valid authenticator.

Successful exploitation yields pre-authentication impersonation of any RADIUS-mapped user in any affected realm. The resulting session is indistinguishable from a legitimate RADIUS login and carries the named principal's privileges.

## Patch
This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_