CVE-2026-48717: Open Identity Platform OpenAM OAuth authorization bypass in PKCE challenge

Executive brief

OpenAM is an identity and access management platform used to secure web applications and services. A security flaw in its login process allows attackers who intercept a temporary authorization code to bypass a security check called PKCE. This could allow an unauthorized person to gain access to a user's account or sensitive data without having the required secret verification key.

Technical details

An improper authorization vulnerability (CWE-285) exists in OpenAM's OAuth2 implementation. While the authorize endpoint correctly stores a code_challenge, the token endpoint only enforces the presence of a code_verifier if the 'codeVerifierEnforced' setting is enabled (it is disabled by default). If this setting is off, an attacker can redeem a PKCE-protected authorization code by simply omitting the code_verifier parameter, as the system only performs a challenge check if a verifier is actually provided. This allows for authorization code injection or interception attacks against public clients. The issue is patched in version 16.1.1.

Affected products

• Open Identity Platform OpenAM Community Edition <= 16.0.6

Timeline

• 2026-06-28: disclosed
• 2026-06-29: advisory

References

• https://api.github.com/users/wodzen
• https://github.com/wodzen
• https://api.github.com/users/wodzen/gists%7B/gist_id%7D
• https://api.github.com/users/wodzen/repos
• https://avatars.githubusercontent.com/u/25558174?v=4
• https://api.github.com/users/wodzen/events%7B/privacy%7D