Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.openidentityplatform.openam:openam-auth-oauth2

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7MavenAmendedPublished

    OpenAM Account Takeover via Unverified Password Change in OAuth2 Module

    CVE-2026-46623 · GHSA-gf57-4mp6-m85x

    Affected
    • Maven org.openidentityplatform.openam:openam-auth-oauth2 < 16.1.1
    Fixed in
    16.1.1· Vendor fix available
    Issue
    Description An Unverified Password Change (CWE-620) and Use of Weak Credentials (CWE-1391) issue in OpenAM's OAuth2 authentication module silently rewrites a local user's password to the literal string of their username on OAuth2 re-login of an existing account. The default ldapService chain then accepts the username as the password for that user, allowing an unauthenticated attacker to obtain a session via the standard authenticate endpoint with both username and password set to the username, without any IdP interaction. This affects OpenAM Community Edition through version 16.0.6 and was patched in version 16.1.1. Impact OpenAM Community Edition deployments through version 16.0.6 that use the OAuth2 authentication module with account creation enabled (the default) are potentially affected. After two OAuth logins of a given user, that user's local password becomes their username, and the account is reachable through the default ldapService chain with username as…

    Recommended action: Upgrade to 16.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →