CVE-2026-46623

Name of the Vulnerable Software and Affected Versions Open Access Management (OpenAM) versions prior to 16.1.1

Description The OAuth2 authentication module fails to implement OAuth.removeRestrictedAccountUpdateAttributes filtering, allowing profile attributes such as userPassword and inetUserStatus to reach the account update process. This flaw enables the system to rewrite a local account password to match the username and reactivate disabled accounts. When account creation is enabled, repeated OAuth logins cause the ldapService chain to accept the username as both the identifier and password. Consequently, an unauthenticated attacker can take over a local account without interacting with the identity provider. This rewrite may be denied if the username is shorter than the configured minimum password length.

Recommendations Update to version 16.1.1.