CVE-2025-64099: OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed
CVE-2025-64099 · Severity: medium · CVSS 4 · Published 2025-11-12
Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the "claims_parameter_supported" parameter is activated, it is possible, thanks to the "oidc-claims-extension.groovy" script, to inject the value of one's choice into a claim contained in the id_token or in the user_info. In the request of an authorize function, a claims parameter containing a JSON file can be injected. This JSON file allows attackers to customize the claims returned by the "id_token" and "user_info" files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, an attacker can choose the email address they want, and therefore assume any identity they choose. Version 16.0.0 fixes the issue.
Yes. org.openidentityplatform.openam:openam-oauth2 (Maven): upgrade to 16.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2025-64099?
Check whether you run org.openidentityplatform.openam:openam-oauth2 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
org.openidentityplatform.openam:openam-oauth2 (Maven): upgrade to 16.0.3 or later
# set org.openidentityplatform.openam:openam-oauth2 to 16.0.3 in your pom.xml or build.gradle