CVE-2026-105117

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3

Description An email content injection issue allows unauthenticated attackers to control the wording of notification emails. This is possible through the forgotPassword and register actions on the '/json/{realm}/users' endpoint. By supplying the subject and message fields, attackers can send phishing emails using the organization's configured From address or use the registration process as a relay to send emails to arbitrary recipients.

Recommendations Update to version 16.1.3 or later. Restrict access to the '/json/{realm}/users' endpoint to minimize the risk of exploitation.