CVE-2026-123549: OpenAM self-registration attribute list enforcement bypass

CVE-2026-123549 · Severity: critical · CVSS 9.8 · Published 2026-11-08

OpenAM is an identity and access management platform that controls authentication and authorization across enterprise systems. A flaw in its self-registration mechanism allows unauthenticated attackers to create accounts with administrative group membership and other restricted attributes, leading to full administrative control of the platform. This compromises all protected applications and data managed by OpenAM, including credential modification and creating additional rogue administrators.

Technologies: Open Identity Platform OpenAM. Vendors: Open Identity Platform.

Quick answers

Is CVE-2026-123549 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-123549 being exploited in the wild.
How severe is CVE-2026-123549?
Critical severity, with a CVSS score of 9.8, published 8 November 2026.
Which products and versions are affected?
Open Identity Platform OpenAM before 16.1.4.
Is there a fix for CVE-2026-123549?
Yes: fixed in 16.1.4. Until then: Disable self-registration in realms that do not require it (check both User Self-Service settings and legacy self-service settings). Where self-registration must remain enabled, disable the legacy endpoint and use only the current User Self-Service flow, and configure reverse proxy rules to reject registration requests attempting to set group membership or attributes outside the Valid Creation Attributes list. Review existing self-registered accounts for unexpected administrative group membership. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123549 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-123549?
Check whether you run Open Identity Platform OpenAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 16.1.4

Disable self-registration in realms that do not require it (check both User Self-Service settings and legacy self-service settings). Where self-registration must remain enabled, disable the legacy endpoint and use only the current User Self-Service flow, and configure reverse proxy rules to reject registration requests attempting to set group membership or attributes outside the Valid Creation Attributes list. Review existing self-registered accounts for unexpected administrative group membership.

Technical details

OpenAM fails to enforce the Valid Creation Attributes list during self-registration in both the legacy REST endpoint and the current User Self-Service flow, particularly for group membership attributes. An anonymous attacker can complete self-registration (typically requiring only a controlled email address) and set themselves as members of administrative groups, gaining server-side administrative privileges. The vulnerability affects all OpenAM versions up to 16.1.3 and is fixed in 16.1.4.

Affected products

  • Open Identity Platform OpenAM before 16.1.4

Timeline

  • 2026-10-22: disclosed
  • 2026-10-22: patched: Fixed in version 16.1.4
  • 2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.