CVE-2026-46560: OpenIdentityPlatform OpenAM auth bypass in RADIUS module

CVE-2026-46560 · Severity: high · CVSS 7.5 · Published 2026-10-30

OpenAM is an identity and access management platform used to control user logins to corporate applications. A security flaw in its RADIUS login component allows attackers to bypass authentication and log in as any user without knowing their password. This could lead to unauthorized access to sensitive company data and systems, effectively allowing an attacker to impersonate any employee.

Technologies: Open Identity Platform OpenAM Community Edition. Vendors: Maven, Open Identity Platform.

Quick answers

Is CVE-2026-46560 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46560 being exploited in the wild.
How severe is CVE-2026-46560?
High severity, with a CVSS score of 7.5, published 30 October 2026.
Which products and versions are affected?
org.openidentityplatform.openam:openam-radius (Maven) < 16.1.1, ECOSYSTEM:introduced=0,fixed=16.1.1; Open Identity Platform OpenAM Community Edition <= 16.0.6.
Is there a fix for CVE-2026-46560?
Yes. org.openidentityplatform.openam:openam-radius (Maven): upgrade to 16.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46560 attacked?
It is attacked from the adjacent network, in a hosted service.
Am I affected by CVE-2026-46560?
Check whether you run org.openidentityplatform.openam:openam-radius (Maven) or Open Identity Platform OpenAM Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.openidentityplatform.openam:openam-radius (Maven): upgrade to 16.1.1 or later
    # set org.openidentityplatform.openam:openam-radius to 16.1.1 in your pom.xml or build.gradle

Technical details

An Improper Verification of Cryptographic Signature (CWE-347) exists in the OpenAM RADIUS authentication module. The RADIUS client implementation fails to verify the Response Authenticator (RFC 2865) and does not check the source IP/port or match response identifiers. An attacker can exploit this by racing a legitimate server or spraying forged Access-Accept UDP packets at the OpenAM client port. Because the client treats any non-Reject/non-Challenge packet as a success without cryptographic verification, an attacker can obtain a valid session for any RADIUS-mapped username. This is patched in version 16.1.1.

Affected products

  • OpenIdentityPlatform OpenAM Community Edition <= 16.0.6

Identifiers

  • CVE-2026-46560
  • GHSA-386j-6m86-78f9

Timeline

  • 2026-06-25: disclosed
  • 2026-06-25: advisory
  • 16.1.1: patched: First patched version

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.