CVE-2026-46498: OpenIdentityPlatform OpenAM OAuth token forgery via Push Registration

Executive brief

OpenAM is an open-source access management solution used to secure web applications and services. A security flaw allows an attacker to create fraudulent digital identity tokens (OAuth2 and OIDC) that can impersonate any user or client. This could allow an attacker to gain unauthorized access to protected resources and data by pretending to be a legitimate user.

Technical details

An Authorization Bypass Through User-Controlled Key (CWE-639) exists in the stateful OAuth2 token-read path of OpenAM. The vulnerability stems from the OAuth2 token-read path reading caller-supplied identifiers from the shared Core Token Store (CTS) without enforcing an OAuth-only namespace or verifying the CTS type against the expected OAuth token family. An attacker who can inject attacker-controlled JSON into the CTS (for example, via a Push Notification SNS callback handler) can forge bearer tokens with arbitrary userName, clientID, realm, and scope. This issue is patched in version 16.1.1.

Affected products

• OpenIdentityPlatform OpenAM Community Edition <= 16.0.6

Timeline

• 2026-06-25: disclosed
• 2026-06-25: advisory: GHSA-cj8f-2fhf-826r published
• 2026-06-25: patched: Version 16.1.1 released

References

• https://api.github.com/users/wodzen
• https://github.com/wodzen
• https://api.github.com/users/wodzen/gists%7B/gist_id%7D
• https://api.github.com/users/wodzen/repos
• https://avatars.githubusercontent.com/u/25558174?v=4
• https://api.github.com/users/wodzen/events%7B/privacy%7D