CVE-2026-123542

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.4

Description The software fails to enforce Proof Key for Code Exchange (PKCE), a security extension for OAuth 2.0, in the device authorization flow. Specifically, the system does not validate the code verifier during the exchange of device codes for tokens. This allows an attacker who obtains an approved device code from shared device storage or client logs to redeem it for ID and access tokens, enabling user impersonation.

Recommendations Update to version 16.1.4 or later.