CVE-2026-105119: OpenAM PKCE enforcement bypass in OAuth 2.0 hybrid flows

CVE-2026-105119 · Severity: medium · CVSS 6.8 · Published 2026-10-03

OpenAM is an identity and access management platform that enforces PKCE (Proof Key for Code Exchange) to protect OAuth 2.0 authorization flows. Before version 16.1.3, this protection is incomplete: it only applies when clients request a specific response type, leaving hybrid flows unprotected. An attacker who intercepts an authorization code from a hybrid flow can redeem it for access tokens without needing the code verifier, potentially gaining unauthorized access to public client applications and user data.

Technologies: Open Identity Platform OpenAM. Vendors: Open Identity Platform.

Quick answers

Is CVE-2026-105119 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-105119 being exploited in the wild.
How severe is CVE-2026-105119?
Medium severity, with a CVSS score of 6.8, published 3 October 2026.
Which products and versions are affected?
Open Identity Platform OpenAM before 16.1.3.
Is there a fix for CVE-2026-105119?
Yes: fixed in 16.1.3. Until then: Restrict response types for OAuth 2.0 and OpenID Connect clients that do not require hybrid flows (especially public clients) by removing code token, code id_token, and code token id_token from their Response Types configuration. For clients that require hybrid flows, use confidential clients with mandatory code_challenge parameters (method S256) and keep authorization code lifetime short (default 120 seconds). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105119 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-105119?
Check whether you run Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 16.1.3

Restrict response types for OAuth 2.0 and OpenID Connect clients that do not require hybrid flows (especially public clients) by removing code token, code id_token, and code token id_token from their Response Types configuration. For clients that require hybrid flows, use confidential clients with mandatory code_challenge parameters (method S256) and keep authorization code lifetime short (default 120 seconds).

Technical details

OpenAM's OAuth2 Provider PKCE enforcement (enabled by default since 16.1.1) only validates the code_challenge parameter when response_type is exactly "code", not for OpenID Connect hybrid flows (code token, code id_token, code token id_token). An attacker who intercepts an authorization code issued via hybrid flow can exchange it for tokens at the token endpoint using any non-empty code_verifier, bypassing the PKCE protection designed to prevent authorization code interception. For public clients, no additional credentials are needed; for confidential clients, the attacker also requires the client authentication credentials.

Affected products

  • Open Identity Platform OpenAM before 16.1.3

Timeline

  • 2026-09-18: disclosed
  • 2026-10-03: advisory
  • 2026-10-03: patched: OpenAM 16.1.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.