CVE-2026-46623: Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing loca

Executive brief

A vulnerability in OpenAM, an identity and access management platform, allows attackers to take over user accounts. When a user logs in via OAuth2, the system may incorrectly reset their local password to match their username. An attacker can then log in directly to the victim's account by simply using the victim's username as both the login ID and the password, bypassing normal security checks.

Technical details

An Unverified Password Change (CWE-620) and Use of Weak Credentials (CWE-1391) exists in the OpenAM OAuth2 authentication module. Upon OAuth2 re-login of an existing account, the module silently rewrites the local user's password to the literal string of their username. Because the default ldapService chain accepts this weak credential, an unauthenticated attacker can obtain a session via the standard authenticate endpoint by providing the username as both the identifier and the password. This issue also silently reactivates disabled accounts during the OAuth login process. The vulnerability is patched in version 16.1.1.

Affected products

• OpenIdentityPlatform openam-auth-oauth2 < 16.1.1

Timeline

• 2026-06-26: advisory
• 2026-06-26: disclosed
• 16.1.1: patched

References

• https://api.github.com/users/wodzen
• https://github.com/wodzen
• https://api.github.com/users/wodzen/gists%7B/gist_id%7D
• https://api.github.com/users/wodzen/repos
• https://avatars.githubusercontent.com/u/25558174?v=4
• https://api.github.com/users/wodzen/events%7B/privacy%7D