Is CVE-2026-46623 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46623 being exploited in the wild.

How severe is CVE-2026-46623?

High severity, with a CVSS score of 4, published 15 September 2026.

Which products and versions are affected?

org.openidentityplatform.openam:openam-auth-oauth2 (Maven) < 16.1.1, ECOSYSTEM:introduced=0,fixed=16.1.1.

Is there a fix for CVE-2026-46623?

Yes. org.openidentityplatform.openam:openam-auth-oauth2 (Maven): upgrade to 16.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46623 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-46623?

Check whether you run org.openidentityplatform.openam:openam-auth-oauth2 (Maven) or Open Identity Platform OpenAM OAuth2 Authentication Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46623: OpenIdentityPlatform OpenAM account takeover in OAuth2 module

Q: Is there a fix for CVE-2026-46623?

Yes. org.openidentityplatform.openam:openam-auth-oauth2 (Maven): upgrade to 16.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46623 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-46623?

Check whether you run org.openidentityplatform.openam:openam-auth-oauth2 (Maven) or Open Identity Platform OpenAM OAuth2 Authentication Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46623 · Severity: high · CVSS 4 · Published 2026-09-15

A vulnerability in OpenAM, an identity and access management platform, allows attackers to take over user accounts. When a user logs in via OAuth2, the system may incorrectly reset their local password to match their username. An attacker can then log in directly to the victim's account by simply using the victim's username as both the login ID and the password, bypassing normal security checks.

Vendors: Maven, Open Identity Platform.

Quick answers

Is CVE-2026-46623 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46623 being exploited in the wild.
How severe is CVE-2026-46623?: High severity, with a CVSS score of 4, published 15 September 2026.
Which products and versions are affected?: org.openidentityplatform.openam:openam-auth-oauth2 (Maven) < 16.1.1, ECOSYSTEM:introduced=0,fixed=16.1.1.
Is there a fix for CVE-2026-46623?: Yes. org.openidentityplatform.openam:openam-auth-oauth2 (Maven): upgrade to 16.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46623 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-46623?: Check whether you run org.openidentityplatform.openam:openam-auth-oauth2 (Maven) or Open Identity Platform OpenAM OAuth2 Authentication Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.openidentityplatform.openam:openam-auth-oauth2 (Maven): upgrade to 16.1.1 or later

# set org.openidentityplatform.openam:openam-auth-oauth2 to 16.1.1 in your pom.xml or build.gradle

Technical details

An Unverified Password Change (CWE-620) and Use of Weak Credentials (CWE-1391) exists in the OpenAM OAuth2 authentication module. Upon OAuth2 re-login of an existing account, the module silently rewrites the local user's password to the literal string of their username. Because the default ldapService chain accepts this weak credential, an unauthenticated attacker can obtain a session via the standard authenticate endpoint by providing the username as both the identifier and the password. This issue also silently reactivates disabled accounts during the OAuth login process. The vulnerability is patched in version 16.1.1.

Affected products

OpenIdentityPlatform openam-auth-oauth2 < 16.1.1

Identifiers

CVE-2026-46623
GHSA-gf57-4mp6-m85x

Timeline

2026-06-26: advisory
2026-06-26: disclosed
16.1.1: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.