CVE-2026-46560: OpenIdentityPlatform OpenAM auth bypass in RADIUS module

Executive brief

OpenAM is an identity and access management platform used to control user logins to corporate applications. A security flaw in its RADIUS login component allows attackers to bypass authentication and log in as any user without knowing their password. This could lead to unauthorized access to sensitive company data and systems, effectively allowing an attacker to impersonate any employee.

Technical details

An Improper Verification of Cryptographic Signature (CWE-347) exists in the OpenAM RADIUS authentication module. The RADIUS client implementation fails to verify the Response Authenticator (RFC 2865) and does not check the source IP/port or match response identifiers. An attacker can exploit this by racing a legitimate server or spraying forged Access-Accept UDP packets at the OpenAM client port. Because the client treats any non-Reject/non-Challenge packet as a success without cryptographic verification, an attacker can obtain a valid session for any RADIUS-mapped username. This is patched in version 16.1.1.

Affected products

• OpenIdentityPlatform OpenAM Community Edition <= 16.0.6

Timeline

• 2026-06-25: disclosed
• 2026-06-25: advisory
• 16.1.1: patched: First patched version

References

• https://api.github.com/users/wodzen
• https://github.com/wodzen
• https://api.github.com/users/wodzen/gists%7B/gist_id%7D
• https://api.github.com/users/wodzen/repos
• https://avatars.githubusercontent.com/u/25558174?v=4
• https://api.github.com/users/wodzen/events%7B/privacy%7D