CVE-2026-47426: Open Identity Platform OpenAM OAuth client impersonation in JWKS resolver

Executive brief

OpenAM is an identity management platform used to control access to applications and services. A security flaw allows a registered user or application to impersonate any other application on the system without knowing its secret keys. This could allow an attacker to gain unauthorized access to sensitive data or perform actions on behalf of trusted corporate services.

Technical details

An Improper Authentication (CWE-287) vulnerability exists in OpenAM's OAuth2 private_key_jwt client authentication path. The flaw resides in the JWKS (JSON Web Key Set) resolver cache, which allows a registered OAuth2 client to mint tokens in the name of any other client that publishes its keys via a jwks_uri. An attacker does not need the victim's private signing key to succeed. This can be exploited by any registered client, including those created via open dynamic client registration. The issue is fixed in version 16.1.1.

Affected products

• Open Identity Platform OpenAM Community Edition <= 16.0.6

Timeline

• 2026-06-28: disclosed
• 2026-06-29: advisory: GHSA-f2cx-463q-7m2c published
• 2026-06-29: patched: Version 16.1.1 released

References

• https://api.github.com/users/wodzen
• https://github.com/wodzen
• https://api.github.com/users/wodzen/gists%7B/gist_id%7D
• https://api.github.com/users/wodzen/repos
• https://avatars.githubusercontent.com/u/25558174?v=4
• https://api.github.com/users/wodzen/events%7B/privacy%7D