Executive brief
OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed
Affected products
- Maven org.openidentityplatform.openam:openam-oauth2
Junglewise Threat Intelligence
CVE-2025-64099: OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed
CVE-2025-64099 · Severity: medium · CVSS 4 · Published 2025-11-12
Technologies: org.openidentityplatform.openam:openam-oauth2 (Maven). Vendors: Maven.
Related threats
- Open Access Management (OpenAM) is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap cons
- Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a code_verifie
- Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the private_key_jwt client authentication path uses Clien
- Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers f
- Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint d