CVE-2026-48717: falha crítica em OpenIdentityPlatform OpenAM
OpenAM OAuth Authorization Bypass via PKCE Challenge
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.5%
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a code_verifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a code_challenge. Because that setting is disabled by default, an attacker who intercepts a PKCE-protected authorization code can omit code_verifier and redeem the code, while an explicitly incorrect verifier is rejected. Public clients are directly affected, and confidential-client exploitation additionally requires client authentication material or another redemption context. This issue is fixed in version 16.1.1.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
OpenIdentityPlatform · OpenAMCVEs relacionadas — OpenIdentityPlatform OpenAM
No mesmo produto, das mais perigosas para as menos.
CVE-2026-33439CRITICALPre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAMEPSS 9.3%CVE-2024-41667HIGHOpenAM FreeMarker template injectionEPSS 3.5%CVE-2023-37471CRITICALUser impersonation using SAMLv1.x SSO in Open Access Management EPSS 1.3%CVE-2026-62379CRITICALOpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallbackEPSS 1.1%CVE-2026-46619CRITICALOpenAM Authentication Bypass via MSISDN LDAP InjectionEPSS 1.0%CVE-2026-62263CRITICALOpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypassEPSS 0.9%