Live › vulnerability › CVE-2026-47426
Go to dashboardOpenAM's OAuth2 private_key_jwt client authentication caches keys fetched from jwks_uri, so a registered client can mint access tokens as another client whose key is published that way, without holding that client's signing key. An attacker gets tokens in the victim client's name across realms hosted by the OpenAM process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 15:29 UTC, 0h before NVD. All times on this page are UTC.
Deployments of OpenAM Community Edition through 16.0.6 that use OAuth2 clients with private_key_jwt authentication and keys published via jwks_uri are exposed. An attacker needs any registered OAuth2 client, which open dynamic client registration can provide. Installations without private_key_jwt clients using jwks_uri, or running a patched version, are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.openidentityplatform.openam:openam-oauth2 | maven | <= 16.0.6 | 16.1.1 |
16.1.1 or later, for example by reading the openam-oauth2 version in the Maven dependency tree16.1.1 or later, the first patched versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Description
An Improper Authentication (CWE-287) issue in OpenAM's OAuth2 private_key_jwt client authentication path allows any registered OAuth2 client to mint tokens in the name of any other client whose key is published via a jwks_uri, without knowing the victim's signing key. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1.
OpenAM Community Edition deployments through version 16.0.6 that have OAuth2 clients configured for private_key_jwt authentication with keys published via jwks_uri are potentially affected. An attacker holding any such client registration, their own, or one obtained through open dynamic client registration where enabled, can mint access tokens in any other such client's name, in any realm hosted by the OpenAM process.
This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.
This page as .md · .json · in your agent: get_signal("CVE-2026-47426")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.