# CVE-2026-105119: OpenAM PKCE enforcement bypass in OAuth 2.0 hybrid flows

Source: https://junglewise.ai/threats/cve-2026-105119-openam-before-16-1-3-applies-its-oauth2-provider-pkce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-03. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105119 · Severity: medium · CVSS 6.8 · Published 2026-10-03

OpenAM is an identity and access management platform that enforces PKCE (Proof Key for Code Exchange) to protect OAuth 2.0 authorization flows. Before version 16.1.3, this protection is incomplete: it only applies when clients request a specific response type, leaving hybrid flows unprotected. An attacker who intercepts an authorization code from a hybrid flow can redeem it for access tokens without needing the code verifier, potentially gaining unauthorized access to public client applications and user data.

Technologies: [Open Identity Platform OpenAM](https://junglewise.ai/threats/technologies/openam). Vendors: [Open Identity Platform](https://junglewise.ai/threats/vendors/open-identity-platform).

## Quick answers

**Is CVE-2026-105119 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105119 being exploited in the wild.

**How severe is CVE-2026-105119?** Medium severity, with a CVSS score of 6.8, published 3 October 2026.

**Which products and versions are affected?** Open Identity Platform OpenAM before 16.1.3.

**Is there a fix for CVE-2026-105119?** Yes: fixed in 16.1.3. Until then: Restrict response types for OAuth 2.0 and OpenID Connect clients that do not require hybrid flows (especially public clients) by removing code token, code id_token, and code token id_token from their Response Types configuration. For clients that require hybrid flows, use confidential clients with mandatory code_challenge parameters (method S256) and keep authorization code lifetime short (default 120 seconds). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105119 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-105119?** Check whether you run Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 16.1.3

Restrict response types for OAuth 2.0 and OpenID Connect clients that do not require hybrid flows (especially public clients) by removing code token, code id_token, and code token id_token from their Response Types configuration. For clients that require hybrid flows, use confidential clients with mandatory code_challenge parameters (method S256) and keep authorization code lifetime short (default 120 seconds).

## Technical details

OpenAM's OAuth2 Provider PKCE enforcement (enabled by default since 16.1.1) only validates the code_challenge parameter when response_type is exactly "code", not for OpenID Connect hybrid flows (code token, code id_token, code token id_token). An attacker who intercepts an authorization code issued via hybrid flow can exchange it for tokens at the token endpoint using any non-empty code_verifier, bypassing the PKCE protection designed to prevent authorization code interception. For public clients, no additional credentials are needed; for confidential clients, the attacker also requires the client authentication credentials.

## Affected products

- Open Identity Platform OpenAM before 16.1.3

## Timeline

- 2026-09-18: disclosed
- 2026-10-03: advisory
- 2026-10-03: patched: OpenAM 16.1.3 released

## References

- [https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5p2f-7vcr-6vfh](https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5p2f-7vcr-6vfh)
- [https://www.vulncheck.com/advisories/openam-before-16.1.3-pkce-enforcement-bypass-via-oauth-2.0-hybrid-flows](https://www.vulncheck.com/advisories/openam-before-16.1.3-pkce-enforcement-bypass-via-oauth-2.0-hybrid-flows)

## Related threats

- [OpenAM default credentials authentication bypass in built-in identities](https://junglewise.ai/threats/cve-2026-123553-openam-before-16-1-4-ships-built-in-identities-in-the-top-level)
- [OpenAM unauthenticated session token disclosure via WebSocket](https://junglewise.ai/threats/cve-2026-123551-openam-from-14-0-0-before-16-1-4-contains-an-information)
- [OpenAM SAML v2.0 service provider authentication bypass](https://junglewise.ai/threats/cve-2026-123550-openam-before-16-1-4-contains-an-authentication-bypass)
- [OpenAM self-registration attribute list enforcement bypass](https://junglewise.ai/threats/cve-2026-123549-openam-before-16-1-4-fails-to-enforce-the-valid-creation)
- [OpenAM open redirect via SAML RelayState](https://junglewise.ai/threats/cve-2026-123547-openam-before-16-1-4-contains-an-open-redirect-vulnerability)