# CVE-2025-64099: OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed

Source: https://junglewise.ai/threats/cve-2025-64099-openam-using-arbitrary-oidc-requested-claims-values-in-id-token  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-12  
License: CC BY 4.0 with a link back

CVE-2025-64099 · Severity: medium · CVSS 4 · Published 2025-11-12

Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the "claims_parameter_supported" parameter is activated, it is possible, thanks to the "oidc-claims-extension.groovy" script, to inject the value of one's choice into a claim contained in the id_token or in the user_info. In the request of an authorize function, a claims parameter containing a JSON file can be injected. This JSON file allows attackers to customize the claims returned by the "id_token" and "user_info" files. This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, an attacker can choose the email address they want, and therefore assume any identity they choose. Version 16.0.0 fixes the issue.

Technologies: [org.openidentityplatform.openam:openam-oauth2 (Maven)](https://junglewise.ai/threats/technologies/org-openidentityplatform-openam-openam-oauth2). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2025-64099 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64099 being exploited in the wild.

**How severe is CVE-2025-64099?** Medium severity, with a CVSS score of 4, published 12 November 2025.

**Which products and versions are affected?** org.openidentityplatform.openam:openam-oauth2 (Maven) ECOSYSTEM:introduced=0,fixed=16.0.3.

**Is there a fix for CVE-2025-64099?** Yes. org.openidentityplatform.openam:openam-oauth2 (Maven): upgrade to 16.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-64099?** Check whether you run org.openidentityplatform.openam:openam-oauth2 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.openidentityplatform.openam:openam-oauth2 (Maven): upgrade to 16.0.3 or later

  ```sh
  # set org.openidentityplatform.openam:openam-oauth2 to 16.0.3 in your pom.xml or build.gradle
  ```


## Affected products

- org.openidentityplatform.openam:openam-oauth2 (Maven) ECOSYSTEM:introduced=0,fixed=16.0.3

## Identifiers

- CVE-2025-64099
- GHSA-39hr-239p-fhqc

## Related threats

- [Open Identity Platform OpenAM Reflected XSS in OAuth2 consent page](https://junglewise.ai/threats/cve-2026-62280-open-identity-platform-openam-reflected-xss-in-oauth2-consent)
- [Open Identity Platform OpenAM OAuth authorization bypass in PKCE challenge](https://junglewise.ai/threats/cve-2026-48717-open-identity-platform-openam-oauth-authorization-bypass-in-pkce)
- [Open Identity Platform OpenAM OAuth client impersonation in JWKS resolver](https://junglewise.ai/threats/cve-2026-47426-open-identity-platform-openam-oauth-client-impersonation-in-jwks)
- [OpenIdentityPlatform OpenAM OAuth token forgery via Push Registration](https://junglewise.ai/threats/cve-2026-46498-openidentityplatform-openam-oauth-token-forgery-via-push)
- [Open Identity Platform OpenAM Reflected XSS in OAuth2 state parameter](https://junglewise.ai/threats/cve-2026-44203-open-identity-platform-openam-reflected-xss-in-oauth2-state)